| Server IP : 103.4.122.14 / Your IP : 216.73.216.103 Web Server : Apache/2.4.62 (Unix) OpenSSL/1.0.2k-fips System : Linux cwp2.slnet.com.au 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 User : statewid ( 1251) PHP Version : 8.3.31 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /usr/local/apache/domlogs/ |
Upload File : |
[Mon Nov 10 19:07:04.765537 2025] [:error] [pid 21990:tid 22004] [client 183.171.67.225:13303] [client 183.171.67.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.171.67.225, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aRHHWKrODeC0Niipo9G14AAAAMw"]
[Mon Nov 10 19:07:25.899142 2025] [:error] [pid 22616:tid 22643] [client 103.240.35.138:46578] [client 103.240.35.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.240.35.138, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aRHHbe3oX-5SdH9T8KAmwAAAANU"]
[Tue Nov 11 04:31:11.453954 2025] [:error] [pid 43436:tid 43470] [client 146.59.228.24:58372] [client 146.59.228.24] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aRJLj9uzjoymDUxEiDgQ-QAAAEM"]
[Tue Nov 11 04:31:12.439846 2025] [:error] [pid 43437:tid 43519] [client 146.59.228.24:58374] [client 146.59.228.24] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/env/.env"] [unique_id "aRJLkALPT6kbVOb_pwuFwAAAAJg"]
[Tue Nov 11 04:31:12.944350 2025] [:error] [pid 43435:tid 43452] [client 146.59.228.24:58386] [client 146.59.228.24] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.env"] [unique_id "aRJLkGeCenDmgzLwDULNigAAAAw"]
[Tue Nov 11 04:31:13.685688 2025] [:error] [pid 43435:tid 43447] [client 146.59.228.24:58392] [client 146.59.228.24] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/vendor/.env"] [unique_id "aRJLkWeCenDmgzLwDULNjAAAAAc"]
[Tue Nov 11 04:31:14.440171 2025] [:error] [pid 43437:tid 43508] [client 146.59.228.24:58406] [client 146.59.228.24] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api2/.env"] [unique_id "aRJLkgLPT6kbVOb_pwuFwgAAAI0"]
[Tue Nov 11 04:31:15.793906 2025] [:error] [pid 43435:tid 43460] [client 146.59.228.24:35570] [client 146.59.228.24] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aRJLk2eCenDmgzLwDULNjwAAABQ"]
[Tue Nov 11 07:10:49.542703 2025] [:error] [pid 33932:tid 33975] [client 101.201.30.4:20540] [client 101.201.30.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aRJw-Zdn2hP2rg5PoHJkaQAAAUg"]
[Tue Nov 11 07:10:50.278514 2025] [:error] [pid 33932:tid 33980] [client 101.201.30.4:20542] [client 101.201.30.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/env/.env"] [unique_id "aRJw-pdn2hP2rg5PoHJkawAAAU0"]
[Tue Nov 11 07:10:50.946200 2025] [:error] [pid 33931:tid 33953] [client 101.201.30.4:20544] [client 101.201.30.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.env"] [unique_id "aRJw-knJb679KZEjo-P6UwAAAQ0"]
[Tue Nov 11 07:10:51.596603 2025] [:error] [pid 33931:tid 33955] [client 101.201.30.4:20546] [client 101.201.30.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/vendor/.env"] [unique_id "aRJw-0nJb679KZEjo-P6VgAAAQ8"]
[Tue Nov 11 07:10:52.245092 2025] [:error] [pid 33931:tid 33949] [client 101.201.30.4:20548] [client 101.201.30.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api2/.env"] [unique_id "aRJw_EnJb679KZEjo-P6WQAAAQk"]
[Tue Nov 11 07:10:54.428328 2025] [:error] [pid 34002:tid 34028] [client 101.201.30.4:43224] [client 101.201.30.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aRJw_tNx46Ag0u620orUVAAAABY"]
[Tue Nov 11 10:08:37.644765 2025] [autoindex:error] [pid 53449:tid 53474] [client 213.199.55.196:57492] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Nov 11 22:26:01.670231 2025] [:error] [pid 49628:tid 49652] [client 159.203.76.199:57600] [client 159.203.76.199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aRNHeb82AgnfnwL7V2Y7RwAAAJY"]
[Wed Nov 12 00:29:22.949104 2025] [:error] [pid 54702:tid 55023] [client 159.203.76.199:44220] [client 159.203.76.199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "aRNkYoCgou0IW-jKFfmILwAAAYk"]
[Wed Nov 12 04:44:09.342552 2025] [:error] [pid 57222:tid 57238] [client 134.199.154.144:44608] [client 134.199.154.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aROgGWGJazH5XCcA91ccOQAAAAs"]
[Wed Nov 12 04:44:09.432991 2025] [:error] [pid 32959:tid 32978] [client 134.199.154.144:34870] [client 134.199.154.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aROgGXoyrq7OJfcFnDihXQAAAQ8"]
[Wed Nov 12 04:59:55.047863 2025] [:error] [pid 57224:tid 57305] [client 172.192.8.227:21483] [client 172.192.8.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.192.8.227, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aROjyxs7oZ7imwCSdAn1rAAAAJU"]
[Wed Nov 12 05:00:28.864031 2025] [:error] [pid 32959:tid 32963] [client 172.192.8.227:21426] [client 172.192.8.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "aROj7Hoyrq7OJfcFnDiqJgAAAQA"]
[Wed Nov 12 05:00:34.283469 2025] [:error] [pid 32959:tid 32966] [client 172.192.8.227:21265] [client 172.192.8.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.192.8.227, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aROj8noyrq7OJfcFnDiqLQAAAQM"]
[Wed Nov 12 05:34:42.786468 2025] [:error] [pid 57223:tid 57257] [client 134.199.154.144:33802] [client 134.199.154.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aROr8hUU8_2aS__aG8ZGXAAAAEA"]
[Wed Nov 12 05:34:52.861782 2025] [:error] [pid 57312:tid 57319] [client 134.199.154.144:53450] [client 134.199.154.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aROr_I0cuHgB17JK5qW8NAAAAMI"]
[Wed Nov 12 16:15:11.227575 2025] [:error] [pid 60095:tid 60115] [client 106.215.162.55:30605] [client 106.215.162.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.215.162.55, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aRRCD3lw2elroagFF1oM3wAAAFA"]
[Wed Nov 12 19:41:01.062986 2025] [:error] [pid 12744:tid 12758] [client 220.247.224.162:62861] [client 220.247.224.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aRRyTZ1cp_ouUvkFj0VoLAAAAQo"]
[Wed Nov 12 19:41:01.590501 2025] [:error] [pid 60180:tid 60191] [client 220.247.224.162:62914] [client 220.247.224.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/include.php"] [unique_id "aRRyTVhgd7ccS8EZg1pPdQAAAUk"]
[Wed Nov 12 19:41:04.527849 2025] [:error] [pid 60405:tid 60411] [client 220.247.224.162:63245] [client 220.247.224.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/hello_dolly_v2.php"] [unique_id "aRRyUHMGv_mlVi6mf5oKjAAAAAM"]
[Wed Nov 12 19:41:05.080518 2025] [:error] [pid 23737:tid 23767] [client 220.247.224.162:63303] [client 220.247.224.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/hello_dolly_v2.php"] [unique_id "aRRyURQUsVVfOZWgW_W18QAAAZI"]
[Wed Nov 12 23:21:22.399499 2025] [:error] [pid 60095:tid 60121] [client 45.153.34.41:56542] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aRSl8nlw2elroagFF1piHQAAAFY"]
[Wed Nov 12 23:51:50.984328 2025] [:error] [pid 23737:tid 23749] [client 45.153.34.41:36356] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aRStFhQUsVVfOZWgW_UDtwAAAYA"]
[Thu Nov 13 03:26:35.262923 2025] [:error] [pid 60405:tid 60427] [client 93.123.109.7:59028] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aRTfa3MGv_mlVi6mf5ptBQAAABM"]
[Thu Nov 13 07:37:01.363818 2025] [:error] [pid 22566:tid 22580] [client 45.89.242.100:36771] [client 45.89.242.100] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aRUaHTfdqWaUbu3e06-1IgAAAQw"]
[Thu Nov 13 11:46:11.071844 2025] [:error] [pid 62217:tid 62276] [client 177.131.19.176:5080] [client 177.131.19.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.131.19.176, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aRVUgxjGU3T9wKBmdNe6BAAAAEI"]
[Thu Nov 13 18:42:50.906345 2025] [:error] [pid 62303:tid 62315] [client 216.81.248.1:47504] [client 216.81.248.1] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aRW2Kr-hlFTtVrZw8jDyegAAAIg"]
[Thu Nov 13 23:33:37.611618 2025] [:error] [pid 4994:tid 5074] [client 38.114.122.142:58504] [client 38.114.122.142] ModSecurity: Access denied with code 403 (phase 2). Found 30 byte(s) in ARGS:_path outside range: 1-255. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "95"] [id "210410"] [rev "4"] [msg "COMODO WAF: Invalid character in request||perthactive.com.au|F|3"] [data "ARGS:_path=_controller=Symfony\\x5cComponent\\x5cYaml\\x5cInline::parse&value=!!php/object:a:1:{i:1;a:2:{i:0;O:32:\\x22Monolog\\x5cHandler\\x5cSyslogUdpHandler\\x22:1:{s:9:\\x22\\x00*\\x00socket\\x22;O:29:\\x22Monolog\\x5cHandler\\x5cBufferHandler\\x22:7:{s:10:\\x22\\x00*\\x00handler\\x22;O:29:\\x22Monolog\\x5cHandler\\x5cBufferHandler\\x22:7:{s:10:\\x22\\x00*\\x00handler\\x22;N;s:13:\\x22\\x00*\\x00bufferSize\\x22;i:-1;s:9:\\x22\\x00*\\x00buffer\\x22;a:1:{i:0;a:2:{i:0;s:2:\\x22-1\\x22;s:5:\\x22level\\x22;N;}}s:8:\\x22\\x00*\\x00level\\x22;N;s:14..."] [severity "ERROR"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/_fragment"] [unique_id "aRX6UQVaYoYtjfBbabUrkgAAAJU"]
[Fri Nov 14 01:53:06.294382 2025] [:error] [pid 56586:tid 56607] [client 159.223.72.153:53793] [client 159.223.72.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "aRYbAq7eYD3G9deYMP5J4QAAAZA"]
[Fri Nov 14 13:21:00.834678 2025] [:error] [pid 16671:tid 16692] [client 136.144.19.205:53605] [client 136.144.19.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/postnews.php"] [unique_id "aRa8PDsoHwEAmeIzZXDoQwAAAQ8"]
[Fri Nov 14 13:21:01.324164 2025] [:error] [pid 16574:tid 16617] [client 136.144.19.196:63597] [client 136.144.19.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/postnews.php"] [unique_id "aRa8Pf6XQqe4NqaoE9LargAAAIo"]
[Fri Nov 14 13:21:01.815172 2025] [:error] [pid 16573:tid 16578] [client 104.234.19.23:64035] [client 104.234.19.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/postnews.php"] [unique_id "aRa8PSPGexfUk9FDoEI40gAAAEA"]
[Fri Nov 14 14:43:10.619532 2025] [:error] [pid 16671:tid 16684] [client 85.203.23.221:41377] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "aRbPfjsoHwEAmeIzZXAKwwAAAQc"]
[Fri Nov 14 14:43:15.812879 2025] [:error] [pid 16709:tid 16718] [client 85.203.23.196:57831] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/covr-wpcom/assets/fonts/manrope_normal.php"] [unique_id "aRbPg6NdzfVNC4oipLUAkwAAAUc"]
[Fri Nov 14 14:43:16.021575 2025] [:error] [pid 16671:tid 16687] [client 85.203.23.183:41131] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/222.php"] [unique_id "aRbPhDsoHwEAmeIzZXAKxwAAAQo"]
[Fri Nov 14 14:43:21.324074 2025] [:error] [pid 16575:tid 16636] [client 85.203.23.204:27385] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/aback.php"] [unique_id "aRbPie6qT670YxigvbBD0AAAAMI"]
[Fri Nov 14 14:43:21.515990 2025] [:error] [pid 16709:tid 16713] [client 85.203.23.209:57681] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/new.php"] [unique_id "aRbPiaNdzfVNC4oipLUAmwAAAUI"]
[Fri Nov 14 14:43:21.714319 2025] [:error] [pid 16709:tid 16721] [client 85.203.23.177:44963] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ad.php"] [unique_id "aRbPiaNdzfVNC4oipLUAnAAAAUo"]
[Fri Nov 14 14:43:21.913466 2025] [:error] [pid 16573:tid 16597] [client 85.203.23.212:57049] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/moderation.php"] [unique_id "aRbPiSPGexfUk9FDoEJWIgAAAFM"]
[Fri Nov 14 14:43:22.129186 2025] [:error] [pid 16709:tid 16712] [client 85.203.23.217:53995] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/classwithtostring.php"] [unique_id "aRbPiqNdzfVNC4oipLUAoAAAAUE"]
[Fri Nov 14 14:43:22.308937 2025] [:error] [pid 16575:tid 16649] [client 85.203.23.211:28743] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/themes.php"] [unique_id "aRbPiu6qT670YxigvbBD0gAAAM8"]
[Fri Nov 14 14:43:22.515204 2025] [:error] [pid 16575:tid 16651] [client 85.203.23.183:60811] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/jindex.php"] [unique_id "aRbPiu6qT670YxigvbBD0wAAANE"]
[Fri Nov 14 14:43:22.712217 2025] [:error] [pid 16573:tid 16602] [client 85.203.23.225:22869] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wso.php"] [unique_id "aRbPiiPGexfUk9FDoEJWJAAAAFg"]
[Fri Nov 14 14:43:23.011698 2025] [:error] [pid 16573:tid 16583] [client 85.203.23.202:20277] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/erinyani/default.php"] [unique_id "aRbPiyPGexfUk9FDoEJWJQAAAEU"]
[Fri Nov 14 14:43:23.215083 2025] [:error] [pid 16709:tid 16724] [client 85.203.23.197:43725] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/leaf.php"] [unique_id "aRbPi6NdzfVNC4oipLUAoQAAAU0"]
[Fri Nov 14 14:43:23.426528 2025] [:error] [pid 16573:tid 16593] [client 85.203.23.205:61981] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/mainhosting/default.php"] [unique_id "aRbPiyPGexfUk9FDoEJWJgAAAE8"]
[Fri Nov 14 14:43:23.707080 2025] [:error] [pid 16573:tid 16580] [client 85.203.23.222:26235] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/about.php"] [unique_id "aRbPiyPGexfUk9FDoEJWJwAAAEI"]
[Fri Nov 14 14:43:24.025622 2025] [:error] [pid 16709:tid 16729] [client 85.203.23.199:43735] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/inc.php"] [unique_id "aRbPjKNdzfVNC4oipLUAowAAAVI"]
[Fri Nov 14 14:43:24.219235 2025] [:error] [pid 16574:tid 16626] [client 85.203.23.188:58919] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/system_log.php"] [unique_id "aRbPjP6XQqe4NqaoE9L2OgAAAJM"]
[Fri Nov 14 14:43:24.410697 2025] [:error] [pid 16574:tid 16608] [client 85.203.23.187:63891] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/gg.php"] [unique_id "aRbPjP6XQqe4NqaoE9L2PQAAAIE"]
[Fri Nov 14 14:43:24.611348 2025] [:error] [pid 16573:tid 16598] [client 85.203.23.192:62519] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/sim.php"] [unique_id "aRbPjCPGexfUk9FDoEJWKwAAAFQ"]
[Fri Nov 14 14:43:25.524292 2025] [:error] [pid 16709:tid 16711] [client 85.203.23.176:37569] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/admin/function.php"] [unique_id "aRbPjaNdzfVNC4oipLUAqgAAAUA"]
[Fri Nov 14 14:43:26.008903 2025] [:error] [pid 16574:tid 16612] [client 85.203.23.195:52249] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/core.php"] [unique_id "aRbPjv6XQqe4NqaoE9L2QQAAAIU"]
[Fri Nov 14 14:43:26.208573 2025] [:error] [pid 16709:tid 16723] [client 85.203.23.212:34035] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/mail.php"] [unique_id "aRbPjqNdzfVNC4oipLUAsgAAAUw"]
[Fri Nov 14 14:43:31.510746 2025] [:error] [pid 16575:tid 16645] [client 85.203.23.172:23197] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/xml.php"] [unique_id "aRbPk-6qT670YxigvbBD4wAAAMs"]
[Fri Nov 14 14:43:31.920895 2025] [:error] [pid 16574:tid 16617] [client 85.203.23.222:47017] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/css.php"] [unique_id "aRbPk_6XQqe4NqaoE9L2RQAAAIo"]
[Fri Nov 14 14:43:32.120466 2025] [:error] [pid 16574:tid 16625] [client 85.203.23.191:48559] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/images/class-config.php"] [unique_id "aRbPlP6XQqe4NqaoE9L2RwAAAJI"]
[Fri Nov 14 14:43:32.311663 2025] [:error] [pid 16671:tid 16690] [client 85.203.23.211:32777] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/g.php"] [unique_id "aRbPlDsoHwEAmeIzZXAK1gAAAQ0"]
[Fri Nov 14 14:43:32.513208 2025] [:error] [pid 16709:tid 16718] [client 85.203.23.177:31257] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-mail.php"] [unique_id "aRbPlKNdzfVNC4oipLUAugAAAUc"]
[Fri Nov 14 14:43:32.707863 2025] [:error] [pid 16709:tid 16723] [client 85.203.23.220:45081] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/default.php"] [unique_id "aRbPlKNdzfVNC4oipLUAvAAAAUw"]
[Fri Nov 14 14:43:32.908278 2025] [:error] [pid 16671:tid 16701] [client 85.203.23.196:47969] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/back.php"] [unique_id "aRbPlDsoHwEAmeIzZXAK2AAAARg"]
[Fri Nov 14 14:43:33.123627 2025] [:error] [pid 16575:tid 16649] [client 85.203.23.212:36635] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aRbPle6qT670YxigvbBD6QAAAM8"]
[Fri Nov 14 14:43:33.326458 2025] [:error] [pid 16671:tid 16682] [client 85.203.23.214:58411] [client 85.203.23.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/content.php"] [unique_id "aRbPlTsoHwEAmeIzZXAK2gAAAQU"]
[Fri Nov 14 14:43:33.510577 2025] [:error] [pid 16671:tid 16677] [client 85.203.23.205:44369] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/leafmailer2.8.php"] [unique_id "aRbPlTsoHwEAmeIzZXAK2wAAAQA"]
[Fri Nov 14 14:43:33.715445 2025] [:error] [pid 16573:tid 16585] [client 85.203.23.182:52925] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "aRbPlSPGexfUk9FDoEJWPwAAAEc"]
[Fri Nov 14 14:43:33.913890 2025] [:error] [pid 16671:tid 16683] [client 85.203.23.223:63839] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/up.php"] [unique_id "aRbPlTsoHwEAmeIzZXAK3AAAAQY"]
[Fri Nov 14 14:43:34.121795 2025] [:error] [pid 16574:tid 16607] [client 85.203.23.170:37709] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wsa.php"] [unique_id "aRbPlv6XQqe4NqaoE9L2SgAAAIA"]
[Fri Nov 14 14:43:34.620661 2025] [:error] [pid 16574:tid 16623] [client 85.203.23.168:55633] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/f35.php"] [unique_id "aRbPlv6XQqe4NqaoE9L2TAAAAJA"]
[Fri Nov 14 14:43:34.823408 2025] [:error] [pid 16709:tid 16732] [client 85.203.23.199:20793] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-l0gin.php"] [unique_id "aRbPlqNdzfVNC4oipLUAxQAAAVU"]
[Fri Nov 14 14:43:35.107426 2025] [:error] [pid 16671:tid 16689] [client 85.203.23.215:55283] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/uploads/index.php"] [unique_id "aRbPlzsoHwEAmeIzZXAK3QAAAQw"]
[Fri Nov 14 14:43:35.317218 2025] [:error] [pid 16671:tid 16685] [client 85.203.23.203:22249] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentyfifteen/shell3.php"] [unique_id "aRbPlzsoHwEAmeIzZXAK4AAAAQg"]
[Fri Nov 14 14:43:35.616707 2025] [:error] [pid 16671:tid 16679] [client 85.203.23.181:26565] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/azusa/inc/wp-host.php"] [unique_id "aRbPlzsoHwEAmeIzZXAK4gAAAQI"]
[Fri Nov 14 14:43:40.814792 2025] [:error] [pid 16671:tid 16694] [client 85.203.23.193:29743] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/woocommerce-to-wechatapp/vendor/overtrue/wechat/src/OpenPlatform/Authorizer/MiniProgram/Domain/Current.php"] [unique_id "aRbPnDsoHwEAmeIzZXAK7QAAARE"]
[Fri Nov 14 14:43:41.012240 2025] [:error] [pid 16575:tid 16643] [client 85.203.23.190:62805] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/an.php"] [unique_id "aRbPne6qT670YxigvbBD7wAAAMk"]
[Fri Nov 14 14:43:41.219609 2025] [:error] [pid 16671:tid 16685] [client 85.203.23.186:32493] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/ga.php"] [unique_id "aRbPnTsoHwEAmeIzZXAK7gAAAQg"]
[Fri Nov 14 14:43:43.020176 2025] [:error] [pid 16573:tid 16583] [client 85.203.23.176:35269] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/post-author-name/index.php"] [unique_id "aRbPnyPGexfUk9FDoEJWSQAAAEU"]
[Fri Nov 14 14:43:43.224972 2025] [:error] [pid 16575:tid 16634] [client 85.203.23.196:62213] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "aRbPn-6qT670YxigvbBD8gAAAMA"]
[Fri Nov 14 14:43:43.620973 2025] [:error] [pid 16709:tid 16722] [client 85.203.23.181:26573] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/list/144.php"] [unique_id "aRbPn6NdzfVNC4oipLUA6QAAAUs"]
[Fri Nov 14 14:43:43.819050 2025] [:error] [pid 16574:tid 16620] [client 85.203.23.168:35501] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/mach.php"] [unique_id "aRbPn_6XQqe4NqaoE9L2WgAAAI0"]
[Fri Nov 14 14:43:44.010639 2025] [:error] [pid 16575:tid 16653] [client 85.203.23.180:38621] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aRbPoO6qT670YxigvbBD9QAAANM"]
[Fri Nov 14 14:43:44.217124 2025] [:error] [pid 16574:tid 16614] [client 85.203.23.192:43593] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/advanced-llms-txt-generator/assets/css/css_json.php"] [unique_id "aRbPoP6XQqe4NqaoE9L2XAAAAIc"]
[Fri Nov 14 14:43:44.413093 2025] [:error] [pid 16709:tid 16717] [client 85.203.23.173:63825] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/kontol/kiw.php"] [unique_id "aRbPoKNdzfVNC4oipLUA7wAAAUY"]
[Fri Nov 14 14:43:44.612562 2025] [:error] [pid 16575:tid 16647] [client 85.203.23.189:57147] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/theme-check/theme-check.php"] [unique_id "aRbPoO6qT670YxigvbBD-QAAAM0"]
[Fri Nov 14 14:43:44.815084 2025] [:error] [pid 16709:tid 16726] [client 85.203.23.168:31049] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/js_composer/include/templates/shortcodes/lock.php"] [unique_id "aRbPoKNdzfVNC4oipLUA8AAAAU8"]
[Fri Nov 14 14:43:45.017918 2025] [:error] [pid 16574:tid 16617] [client 85.203.23.200:51267] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aRbPof6XQqe4NqaoE9L2YgAAAIo"]
[Fri Nov 14 14:43:45.222461 2025] [:error] [pid 16671:tid 16677] [client 85.203.23.181:64607] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/chosen.php"] [unique_id "aRbPoTsoHwEAmeIzZXAK9AAAAQA"]
[Fri Nov 14 14:43:45.411200 2025] [:error] [pid 16574:tid 16627] [client 85.203.23.189:34207] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aRbPof6XQqe4NqaoE9L2ZQAAAJQ"]
[Fri Nov 14 14:43:45.623918 2025] [:error] [pid 16709:tid 16716] [client 85.203.23.170:51443] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/pwnd/cloud.php"] [unique_id "aRbPoaNdzfVNC4oipLUA8QAAAUU"]
[Fri Nov 14 14:43:45.811718 2025] [:error] [pid 16709:tid 16720] [client 85.203.23.173:31951] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-content.php"] [unique_id "aRbPoaNdzfVNC4oipLUA8gAAAUk"]
[Fri Nov 14 14:43:46.012391 2025] [:error] [pid 16575:tid 16643] [client 85.203.23.209:41249] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-post-data.php"] [unique_id "aRbPou6qT670YxigvbBD_QAAAMk"]
[Fri Nov 14 14:43:46.210005 2025] [:error] [pid 16574:tid 16607] [client 85.203.23.182:21557] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aRbPov6XQqe4NqaoE9L2aQAAAIA"]
[Fri Nov 14 14:43:46.425306 2025] [:error] [pid 16574:tid 16618] [client 85.203.23.208:33001] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/m.php"] [unique_id "aRbPov6XQqe4NqaoE9L2agAAAIs"]
[Fri Nov 14 14:43:46.623192 2025] [:error] [pid 16671:tid 16694] [client 85.203.23.195:40793] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/coffee/colors_26.php"] [unique_id "aRbPojsoHwEAmeIzZXAK9gAAARE"]
[Fri Nov 14 14:43:46.815968 2025] [:error] [pid 16671:tid 16680] [client 85.203.23.184:48209] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/"] [unique_id "aRbPojsoHwEAmeIzZXAK-QAAAQM"]
[Fri Nov 14 14:43:52.124714 2025] [:error] [pid 16709:tid 16716] [client 85.203.23.178:37159] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/pwnd/wp-backing.php"] [unique_id "aRbPqKNdzfVNC4oipLUBBwAAAUU"]
[Fri Nov 14 14:43:52.321713 2025] [:error] [pid 16575:tid 16642] [client 85.203.23.187:38617] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/covr-wpcom/assets/fonts/manrope.php"] [unique_id "aRbPqO6qT670YxigvbBEAwAAAMg"]
[Fri Nov 14 14:43:52.510767 2025] [:error] [pid 16573:tid 16583] [client 85.203.23.186:48489] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/blue/acxx.php"] [unique_id "aRbPqCPGexfUk9FDoEJWUwAAAEU"]
[Fri Nov 14 14:43:52.717232 2025] [:error] [pid 16575:tid 16643] [client 85.203.23.218:60349] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/modern/about.php"] [unique_id "aRbPqO6qT670YxigvbBEBQAAAMk"]
[Fri Nov 14 14:43:52.920171 2025] [:error] [pid 16575:tid 16636] [client 85.203.23.190:36163] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/class-ftp.php"] [unique_id "aRbPqO6qT670YxigvbBEBgAAAMI"]
[Fri Nov 14 14:43:53.114277 2025] [:error] [pid 16671:tid 16679] [client 85.203.23.217:44255] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/about.php"] [unique_id "aRbPqTsoHwEAmeIzZXALCwAAAQI"]
[Fri Nov 14 14:43:53.313880 2025] [:error] [pid 16671:tid 16692] [client 85.203.23.180:20833] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/akismet/_inc/img/about.php"] [unique_id "aRbPqTsoHwEAmeIzZXALDAAAAQ8"]
[Fri Nov 14 14:43:53.606402 2025] [:error] [pid 16574:tid 16620] [client 85.203.23.209:25307] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/call-now-button/src/about.php"] [unique_id "aRbPqf6XQqe4NqaoE9L2fwAAAI0"]
[Fri Nov 14 14:43:53.815221 2025] [:error] [pid 16574:tid 16624] [client 85.203.23.181:46319] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wordpress-seo/about.php"] [unique_id "aRbPqf6XQqe4NqaoE9L2gAAAAJE"]
[Fri Nov 14 14:43:54.013255 2025] [:error] [pid 16575:tid 16639] [client 85.203.23.186:61245] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wordpress-seo/admin/pages/about.php"] [unique_id "aRbPqu6qT670YxigvbBECgAAAMU"]
[Fri Nov 14 14:43:54.218846 2025] [:error] [pid 16573:tid 16578] [client 85.203.23.202:43033] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wp-mail-smtp/assets/about.php"] [unique_id "aRbPqiPGexfUk9FDoEJWVQAAAEA"]
[Fri Nov 14 14:43:54.411629 2025] [:error] [pid 16709:tid 16733] [client 85.203.23.168:37983] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wp-optimize/vendor/mrclay/minify/static/about.php"] [unique_id "aRbPqqNdzfVNC4oipLUBCwAAAVY"]
[Fri Nov 14 14:43:54.614746 2025] [:error] [pid 16671:tid 16699] [client 85.203.23.220:64843] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wp-smushit/_src/js/common/about.php"] [unique_id "aRbPqjsoHwEAmeIzZXALDwAAARY"]
[Fri Nov 14 14:43:54.821637 2025] [:error] [pid 16574:tid 16628] [client 85.203.23.186:48927] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wp-smushit/core/modules/background/about.php"] [unique_id "aRbPqv6XQqe4NqaoE9L2gQAAAJU"]
[Fri Nov 14 14:43:55.020670 2025] [:error] [pid 16671:tid 16700] [client 85.203.23.185:58223] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/astra/about.php"] [unique_id "aRbPqzsoHwEAmeIzZXALEAAAARc"]
[Fri Nov 14 14:43:55.216912 2025] [:error] [pid 16671:tid 16690] [client 85.203.23.185:55711] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/astra/inc/blog/about.php"] [unique_id "aRbPqzsoHwEAmeIzZXALEQAAAQ0"]
[Fri Nov 14 14:43:55.424328 2025] [:error] [pid 16574:tid 16623] [client 85.203.23.182:25471] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/astra/template-parts/advanced-footer/about.php"] [unique_id "aRbPq_6XQqe4NqaoE9L2gwAAAJA"]
[Fri Nov 14 14:43:55.615974 2025] [:error] [pid 16709:tid 16713] [client 85.203.23.181:35649] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/astra/wp-login.php"] [unique_id "aRbPq6NdzfVNC4oipLUBDgAAAUI"]
[Fri Nov 14 14:43:55.814357 2025] [:error] [pid 16709:tid 16721] [client 85.203.23.191:42847] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/paradox/option-tree/assets/js/vendor/jquery/about.php"] [unique_id "aRbPq6NdzfVNC4oipLUBDwAAAUo"]
[Fri Nov 14 14:43:56.020608 2025] [:error] [pid 16709:tid 16712] [client 85.203.23.193:34079] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyfive/assets/fonts/roboto-slab/about.php"] [unique_id "aRbPrKNdzfVNC4oipLUBEQAAAUE"]
[Fri Nov 14 14:44:01.313905 2025] [:error] [pid 16671:tid 16681] [client 85.203.23.205:57963] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Cookie/about.php"] [unique_id "aRbPsTsoHwEAmeIzZXALGwAAAQQ"]
[Fri Nov 14 14:44:01.723148 2025] [:error] [pid 16573:tid 16584] [client 85.203.23.177:21003] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Proxy/about.php"] [unique_id "aRbPsSPGexfUk9FDoEJWYAAAAEY"]
[Fri Nov 14 14:44:01.911264 2025] [:error] [pid 16574:tid 16613] [client 85.203.23.189:42623] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Utility/about.php"] [unique_id "aRbPsf6XQqe4NqaoE9L2igAAAIY"]
[Fri Nov 14 14:44:07.110251 2025] [:error] [pid 16573:tid 16594] [client 85.203.23.220:44069] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/comments-pagination-numbers/about.php"] [unique_id "aRbPtyPGexfUk9FDoEJWZQAAAFA"]
[Fri Nov 14 14:44:07.324782 2025] [:error] [pid 16709:tid 16719] [client 85.203.23.220:58895] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/comments-title/about.php"] [unique_id "aRbPt6NdzfVNC4oipLUBJAAAAUg"]
[Fri Nov 14 14:44:07.517437 2025] [:error] [pid 16709:tid 16734] [client 85.203.23.211:51097] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/image/about.php"] [unique_id "aRbPt6NdzfVNC4oipLUBJgAAAVc"]
[Fri Nov 14 14:44:07.711675 2025] [:error] [pid 16573:tid 16581] [client 85.203.23.193:26029] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/latest-posts/about.php"] [unique_id "aRbPtyPGexfUk9FDoEJWZgAAAEM"]
[Fri Nov 14 14:44:07.906196 2025] [:error] [pid 16709:tid 16733] [client 85.203.23.225:21975] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/more/about.php"] [unique_id "aRbPt6NdzfVNC4oipLUBKQAAAVY"]
[Fri Nov 14 14:44:08.112893 2025] [:error] [pid 16573:tid 16584] [client 85.203.23.221:30017] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/page-list-item/about.php"] [unique_id "aRbPuCPGexfUk9FDoEJWZwAAAEY"]
[Fri Nov 14 14:44:08.313791 2025] [:error] [pid 16574:tid 16626] [client 85.203.23.224:39249] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/site-title/about.php"] [unique_id "aRbPuP6XQqe4NqaoE9L2jQAAAJM"]
[Fri Nov 14 14:44:08.510320 2025] [:error] [pid 16575:tid 16648] [client 85.203.23.176:37247] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/components/index.php"] [unique_id "aRbPuO6qT670YxigvbBEHQAAAM4"]
[Fri Nov 14 14:44:10.316635 2025] [:error] [pid 16574:tid 16631] [client 85.203.23.187:48425] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/about.php"] [unique_id "aRbPuv6XQqe4NqaoE9L2kQAAAJg"]
[Fri Nov 14 14:44:10.515241 2025] [:error] [pid 16573:tid 16580] [client 85.203.23.166:54661] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/plugins/wptextpattern/about.php"] [unique_id "aRbPuiPGexfUk9FDoEJWbAAAAEI"]
[Fri Nov 14 14:44:10.722512 2025] [:error] [pid 16574:tid 16616] [client 85.203.23.223:40245] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/wp-login.php"] [unique_id "aRbPuv6XQqe4NqaoE9L2kgAAAIk"]
[Fri Nov 14 14:44:15.908774 2025] [:error] [pid 16573:tid 16581] [client 85.203.23.187:22775] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/namespaced/Core/about.php"] [unique_id "aRbPvyPGexfUk9FDoEJWhAAAAEM"]
[Fri Nov 14 14:44:16.110981 2025] [:error] [pid 16574:tid 16628] [client 85.203.23.176:65311] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/new.php"] [unique_id "aRbPwP6XQqe4NqaoE9L2qAAAAJU"]
[Fri Nov 14 14:44:16.311404 2025] [:error] [pid 16574:tid 16629] [client 85.203.23.196:45037] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/block-directory/index.php"] [unique_id "aRbPwP6XQqe4NqaoE9L2qgAAAJY"]
[Fri Nov 14 14:44:16.518679 2025] [:error] [pid 16709:tid 16717] [client 85.203.23.205:32691] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/back.php"] [unique_id "aRbPwKNdzfVNC4oipLUBNQAAAUY"]
[Fri Nov 14 14:44:17.118016 2025] [:error] [pid 16709:tid 16726] [client 85.203.23.188:27905] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/aves.php"] [unique_id "aRbPwaNdzfVNC4oipLUBNgAAAU8"]
[Fri Nov 14 14:44:17.504973 2025] [:error] [pid 16709:tid 16721] [client 85.203.23.221:58007] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/index.php"] [unique_id "aRbPwaNdzfVNC4oipLUBNwAAAUo"]
[Fri Nov 14 14:44:17.708748 2025] [:error] [pid 16671:tid 16679] [client 85.203.23.214:54003] [client 85.203.23.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/admin.php"] [unique_id "aRbPwTsoHwEAmeIzZXALKgAAAQI"]
[Fri Nov 14 14:44:17.911566 2025] [:error] [pid 16575:tid 16655] [client 85.203.23.196:31517] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/goods.php"] [unique_id "aRbPwe6qT670YxigvbBEPwAAANU"]
[Fri Nov 14 14:44:18.129261 2025] [:error] [pid 16573:tid 16590] [client 85.203.23.186:25447] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/m.php"] [unique_id "aRbPwiPGexfUk9FDoEJWjgAAAEw"]
[Fri Nov 14 14:44:18.312009 2025] [:error] [pid 16709:tid 16729] [client 85.203.23.224:20475] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/admin.php"] [unique_id "aRbPwqNdzfVNC4oipLUBOQAAAVI"]
[Fri Nov 14 14:44:18.509663 2025] [:error] [pid 16709:tid 16714] [client 85.203.23.173:33117] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/css/index.php"] [unique_id "aRbPwqNdzfVNC4oipLUBOgAAAUM"]
[Fri Nov 14 14:44:18.715133 2025] [:error] [pid 16709:tid 16730] [client 85.203.23.166:50533] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "aRbPwqNdzfVNC4oipLUBPAAAAVM"]
[Fri Nov 14 14:44:18.913771 2025] [:error] [pid 16709:tid 16734] [client 85.203.23.224:61739] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aRbPwqNdzfVNC4oipLUBPQAAAVc"]
[Fri Nov 14 14:44:19.118970 2025] [:error] [pid 16574:tid 16626] [client 85.203.23.168:30675] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp.php"] [unique_id "aRbPw_6XQqe4NqaoE9L2tgAAAJM"]
[Fri Nov 14 14:44:19.323073 2025] [:error] [pid 16573:tid 16584] [client 85.203.23.180:41917] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bless.php"] [unique_id "aRbPwyPGexfUk9FDoEJWkAAAAEY"]
[Fri Nov 14 14:44:19.521611 2025] [:error] [pid 16573:tid 16583] [client 85.203.23.193:45873] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "aRbPwyPGexfUk9FDoEJWkQAAAEU"]
[Fri Nov 14 14:44:19.713641 2025] [:error] [pid 16573:tid 16600] [client 85.203.23.172:20575] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/load.php"] [unique_id "aRbPwyPGexfUk9FDoEJWkgAAAFY"]
[Fri Nov 14 14:44:19.914835 2025] [:error] [pid 16575:tid 16652] [client 85.203.23.217:33555] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aRbPw-6qT670YxigvbBERAAAANI"]
[Fri Nov 14 14:44:25.123797 2025] [:error] [pid 16575:tid 16639] [client 85.203.23.171:56951] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/about.php"] [unique_id "aRbPye6qT670YxigvbBETQAAAMU"]
[Fri Nov 14 14:44:25.312433 2025] [:error] [pid 16573:tid 16596] [client 85.203.23.172:57755] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/"] [unique_id "aRbPySPGexfUk9FDoEJWnQAAAFI"]
[Fri Nov 14 14:44:25.519062 2025] [:error] [pid 16573:tid 16598] [client 85.203.23.188:30633] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/2024/index.php"] [unique_id "aRbPySPGexfUk9FDoEJWngAAAFQ"]
[Fri Nov 14 14:44:25.722638 2025] [:error] [pid 16575:tid 16650] [client 85.203.23.183:52209] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/files.php"] [unique_id "aRbPye6qT670YxigvbBETwAAANA"]
[Fri Nov 14 14:44:25.913335 2025] [:error] [pid 16709:tid 16718] [client 85.203.23.208:61689] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/classwithtostring.php"] [unique_id "aRbPyaNdzfVNC4oipLUBRQAAAUc"]
[Fri Nov 14 14:44:26.112741 2025] [:error] [pid 16709:tid 16728] [client 85.203.23.191:21607] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aRbPyqNdzfVNC4oipLUBSQAAAVE"]
[Fri Nov 14 14:44:26.312730 2025] [:error] [pid 16573:tid 16581] [client 85.203.23.192:44233] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/moon.php"] [unique_id "aRbPyiPGexfUk9FDoEJWoQAAAEM"]
[Fri Nov 14 14:44:26.509274 2025] [:error] [pid 16709:tid 16733] [client 85.203.23.204:40723] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/admin/index.php"] [unique_id "aRbPyqNdzfVNC4oipLUBTAAAAVY"]
[Fri Nov 14 14:44:26.713239 2025] [:error] [pid 16574:tid 16616] [client 85.203.23.199:57709] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/about.php"] [unique_id "aRbPyv6XQqe4NqaoE9L2wQAAAIk"]
[Fri Nov 14 14:44:26.915098 2025] [:error] [pid 16671:tid 16693] [client 85.203.23.180:63247] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aRbPyjsoHwEAmeIzZXALPQAAARA"]
[Fri Nov 14 14:44:27.117666 2025] [:error] [pid 16671:tid 16680] [client 85.203.23.191:32345] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/inputs.php"] [unique_id "aRbPyzsoHwEAmeIzZXALPgAAAQM"]
[Fri Nov 14 14:44:27.308248 2025] [:error] [pid 16574:tid 16618] [client 85.203.23.181:23577] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aRbPy_6XQqe4NqaoE9L2wwAAAIs"]
[Fri Nov 14 14:44:27.511297 2025] [:error] [pid 16574:tid 16617] [client 85.203.23.184:33369] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/admin-header.php"] [unique_id "aRbPy_6XQqe4NqaoE9L2xQAAAIo"]
[Fri Nov 14 14:44:27.713897 2025] [:error] [pid 16671:tid 16691] [client 85.203.23.218:22557] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "aRbPyzsoHwEAmeIzZXALQwAAAQ4"]
[Fri Nov 14 14:44:27.943755 2025] [:error] [pid 16575:tid 16651] [client 85.203.23.211:64007] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/autoload_classmap/function.php"] [unique_id "aRbPy-6qT670YxigvbBEVgAAANE"]
[Fri Nov 14 14:44:28.123609 2025] [:error] [pid 16671:tid 16688] [client 85.203.23.168:42251] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/"] [unique_id "aRbPzDsoHwEAmeIzZXALRQAAAQs"]
[Fri Nov 14 14:44:28.323565 2025] [:error] [pid 16573:tid 16599] [client 85.203.23.203:45747] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/404.php"] [unique_id "aRbPzCPGexfUk9FDoEJWpAAAAFU"]
[Fri Nov 14 14:44:28.516587 2025] [:error] [pid 16574:tid 16624] [client 85.203.23.218:42489] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "aRbPzP6XQqe4NqaoE9L2yAAAAJE"]
[Fri Nov 14 14:44:33.909098 2025] [:error] [pid 16573:tid 16595] [client 85.203.23.222:44553] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/index.php"] [unique_id "aRbP0SPGexfUk9FDoEJWrAAAAFE"]
[Fri Nov 14 14:44:34.114237 2025] [:error] [pid 16574:tid 16628] [client 85.203.23.190:61765] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "aRbP0v6XQqe4NqaoE9L2zAAAAJU"]
[Fri Nov 14 14:44:34.318647 2025] [:error] [pid 16709:tid 16734] [client 85.203.23.166:26749] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-config-sample.php"] [unique_id "aRbP0qNdzfVNC4oipLUBXgAAAVc"]
[Fri Nov 14 14:44:34.507696 2025] [:error] [pid 16574:tid 16611] [client 85.203.23.201:53003] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aRbP0v6XQqe4NqaoE9L2zQAAAIQ"]
[Fri Nov 14 14:44:39.817697 2025] [:error] [pid 16709:tid 16713] [client 85.203.23.186:61705] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/nav.php"] [unique_id "aRbP16NdzfVNC4oipLUBawAAAUI"]
[Fri Nov 14 14:44:40.320455 2025] [:error] [pid 16671:tid 16695] [client 85.203.23.184:57353] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/sketch/404.php"] [unique_id "aRbP2DsoHwEAmeIzZXALWQAAARI"]
[Fri Nov 14 14:44:45.606643 2025] [:error] [pid 16709:tid 16725] [client 85.203.23.204:32321] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aRbP3aNdzfVNC4oipLUBdwAAAU4"]
[Fri Nov 14 14:44:45.814037 2025] [:error] [pid 16671:tid 16694] [client 85.203.23.211:49359] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/404.php"] [unique_id "aRbP3TsoHwEAmeIzZXALZAAAARE"]
[Fri Nov 14 14:44:46.008683 2025] [:error] [pid 16575:tid 16644] [client 85.203.23.176:49887] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/"] [unique_id "aRbP3u6qT670YxigvbBEXwAAAMo"]
[Fri Nov 14 14:44:46.322249 2025] [:error] [pid 16709:tid 16734] [client 85.203.23.224:48139] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aRbP3qNdzfVNC4oipLUBeAAAAVc"]
[Fri Nov 14 14:44:46.513237 2025] [:error] [pid 16574:tid 16616] [client 85.203.23.182:47033] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/k.php"] [unique_id "aRbP3v6XQqe4NqaoE9L23AAAAIk"]
[Fri Nov 14 14:44:52.022066 2025] [:error] [pid 16573:tid 16594] [client 85.203.23.212:22809] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-bindings/"] [unique_id "aRbP5CPGexfUk9FDoEJWvQAAAFA"]
[Fri Nov 14 14:44:53.102203 2025] [:error] [pid 16709:tid 16728] [client 85.203.23.166:45145] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aRbP5aNdzfVNC4oipLUBgAAAAVE"]
[Fri Nov 14 14:44:53.323951 2025] [:error] [pid 16573:tid 16600] [client 85.203.23.215:20783] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/privacy-tools.min.php"] [unique_id "aRbP5SPGexfUk9FDoEJWvwAAAFY"]
[Fri Nov 14 14:44:58.515014 2025] [:error] [pid 16575:tid 16637] [client 85.203.23.168:24867] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-links.php"] [unique_id "aRbP6u6qT670YxigvbBEawAAAMM"]
[Fri Nov 14 14:45:00.314634 2025] [:error] [pid 16709:tid 16732] [client 85.203.23.196:26727] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/chosen.php"] [unique_id "aRbP7KNdzfVNC4oipLUBnwAAAVU"]
[Fri Nov 14 14:45:00.709076 2025] [:error] [pid 16574:tid 16631] [client 85.203.23.209:27971] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "aRbP7P6XQqe4NqaoE9L27QAAAJg"]
[Fri Nov 14 14:45:00.923041 2025] [:error] [pid 16574:tid 16618] [client 85.203.23.171:52325] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-file.php"] [unique_id "aRbP7P6XQqe4NqaoE9L27gAAAIs"]
[Fri Nov 14 14:45:01.121828 2025] [:error] [pid 16575:tid 16651] [client 85.203.23.177:42373] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/shell.php"] [unique_id "aRbP7e6qT670YxigvbBEfAAAANE"]
[Fri Nov 14 14:45:01.321465 2025] [:error] [pid 16575:tid 16637] [client 85.203.23.180:38183] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ws.php"] [unique_id "aRbP7e6qT670YxigvbBEgAAAAMM"]
[Fri Nov 14 14:45:01.521263 2025] [:error] [pid 16671:tid 16686] [client 85.203.23.184:44229] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ty.php"] [unique_id "aRbP7TsoHwEAmeIzZXALhQAAAQk"]
[Fri Nov 14 14:45:01.806396 2025] [:error] [pid 16671:tid 16701] [client 85.203.23.173:50349] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/readme.php"] [unique_id "aRbP7TsoHwEAmeIzZXALhgAAARg"]
[Fri Nov 14 14:45:02.019239 2025] [:error] [pid 16573:tid 16597] [client 85.203.23.184:62699] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aRbP7iPGexfUk9FDoEJWyQAAAFM"]
[Fri Nov 14 14:45:07.219627 2025] [:error] [pid 16573:tid 16593] [client 85.203.23.192:44887] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/license.php"] [unique_id "aRbP8yPGexfUk9FDoEJW0QAAAE8"]
[Fri Nov 14 14:45:07.414031 2025] [:error] [pid 16709:tid 16716] [client 85.203.23.168:26307] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/admin-ajax.php"] [unique_id "aRbP86NdzfVNC4oipLUCRwAAAUU"]
[Fri Nov 14 14:45:07.718188 2025] [:error] [pid 16574:tid 16608] [client 85.203.23.221:38565] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/WordPressCore/include.php"] [unique_id "aRbP8_6XQqe4NqaoE9L29QAAAIE"]
[Fri Nov 14 14:45:07.910753 2025] [:error] [pid 16671:tid 16691] [client 85.203.23.205:55365] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content.php"] [unique_id "aRbP8zsoHwEAmeIzZXALiwAAAQ4"]
[Fri Nov 14 14:45:08.207505 2025] [:error] [pid 16709:tid 16732] [client 85.203.23.225:33097] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-configs.php"] [unique_id "aRbP9KNdzfVNC4oipLUCSAAAAVU"]
[Fri Nov 14 14:45:08.423143 2025] [:error] [pid 16574:tid 16621] [client 85.203.23.225:62991] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/index.php"] [unique_id "aRbP9P6XQqe4NqaoE9L29gAAAI4"]
[Fri Nov 14 14:45:08.615147 2025] [:error] [pid 16575:tid 16635] [client 85.203.23.189:36541] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/components/index.php"] [unique_id "aRbP9O6qT670YxigvbBEmQAAAME"]
[Fri Nov 14 14:45:08.808764 2025] [:error] [pid 16573:tid 16594] [client 85.203.23.208:32547] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/1.php"] [unique_id "aRbP9CPGexfUk9FDoEJW1QAAAFA"]
[Fri Nov 14 14:45:09.014273 2025] [:error] [pid 16574:tid 16619] [client 85.203.23.176:53989] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/system.php"] [unique_id "aRbP9f6XQqe4NqaoE9L2-QAAAIw"]
[Fri Nov 14 14:45:09.215034 2025] [:error] [pid 16671:tid 16693] [client 85.203.23.221:55361] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/radio.php"] [unique_id "aRbP9TsoHwEAmeIzZXALjAAAARA"]
[Fri Nov 14 14:45:09.414094 2025] [:error] [pid 16575:tid 16647] [client 85.203.23.220:45769] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/zasf"] [unique_id "aRbP9e6qT670YxigvbBEnQAAAM0"]
[Fri Nov 14 14:45:09.613282 2025] [:error] [pid 16573:tid 16578] [client 85.203.23.215:53899] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/av.php"] [unique_id "aRbP9SPGexfUk9FDoEJW2AAAAEA"]
[Fri Nov 14 14:45:09.816606 2025] [:error] [pid 16709:tid 16725] [client 85.203.23.173:28891] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-json-ajax-session.php"] [unique_id "aRbP9aNdzfVNC4oipLUCSgAAAU4"]
[Fri Nov 14 14:45:10.024146 2025] [:error] [pid 16671:tid 16684] [client 85.203.23.170:50851] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aRbP9jsoHwEAmeIzZXALjgAAAQc"]
[Fri Nov 14 14:45:10.220185 2025] [:error] [pid 16671:tid 16681] [client 85.203.23.188:52969] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aRbP9jsoHwEAmeIzZXALjwAAAQQ"]
[Fri Nov 14 14:45:10.509600 2025] [:error] [pid 16574:tid 16616] [client 85.203.23.204:58347] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-conflg.php"] [unique_id "aRbP9v6XQqe4NqaoE9L2-gAAAIk"]
[Fri Nov 14 14:45:10.714046 2025] [:error] [pid 16573:tid 16591] [client 85.203.23.188:59515] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aRbP9iPGexfUk9FDoEJW3QAAAE0"]
[Fri Nov 14 14:45:10.907213 2025] [:error] [pid 16573:tid 16586] [client 85.203.23.214:35101] [client 85.203.23.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/"] [unique_id "aRbP9iPGexfUk9FDoEJW4AAAAEg"]
[Fri Nov 14 14:45:16.110432 2025] [:error] [pid 16574:tid 16624] [client 85.203.23.188:56441] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/archives/"] [unique_id "aRbP_P6XQqe4NqaoE9L3BwAAAJE"]
[Fri Nov 14 14:45:16.310864 2025] [:error] [pid 16573:tid 16598] [client 85.203.23.214:62829] [client 85.203.23.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aRbP_CPGexfUk9FDoEJW_gAAAFQ"]
[Fri Nov 14 14:45:16.701954 2025] [:error] [pid 16574:tid 16626] [client 85.203.23.225:58975] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aRbP_P6XQqe4NqaoE9L3CAAAAJM"]
[Fri Nov 14 14:45:17.114856 2025] [:error] [pid 16709:tid 16718] [client 85.203.23.223:40183] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aRbP_aNdzfVNC4oipLUCbgAAAUc"]
[Fri Nov 14 14:45:17.619458 2025] [:error] [pid 16709:tid 16724] [client 85.203.23.218:54511] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aRbP_aNdzfVNC4oipLUCcAAAAU0"]
[Fri Nov 14 14:45:18.001620 2025] [:error] [pid 16573:tid 16592] [client 85.203.23.192:59393] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/options.php"] [unique_id "aRbP_iPGexfUk9FDoEJXAgAAAE4"]
[Fri Nov 14 14:45:18.223450 2025] [:error] [pid 16671:tid 16678] [client 85.203.23.185:63049] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/about.php"] [unique_id "aRbP_jsoHwEAmeIzZXALngAAAQE"]
[Fri Nov 14 14:45:23.425017 2025] [:error] [pid 16574:tid 16611] [client 85.203.23.168:35267] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/shell/index.php"] [unique_id "aRbQA_6XQqe4NqaoE9L3DwAAAIQ"]
[Fri Nov 14 14:45:23.610489 2025] [:error] [pid 16573:tid 16580] [client 85.203.23.224:41005] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aRbQAyPGexfUk9FDoEJXBAAAAEI"]
[Fri Nov 14 14:45:28.813108 2025] [:error] [pid 16575:tid 16651] [client 85.203.23.221:41709] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-signup.php"] [unique_id "aRbQCO6qT670YxigvbBExgAAANE"]
[Fri Nov 14 14:45:29.015564 2025] [:error] [pid 16573:tid 16588] [client 85.203.23.168:46933] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "aRbQCSPGexfUk9FDoEJXEQAAAEo"]
[Fri Nov 14 14:45:29.218321 2025] [:error] [pid 16575:tid 16653] [client 85.203.23.187:32627] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aRbQCe6qT670YxigvbBExwAAANM"]
[Fri Nov 14 14:45:29.415563 2025] [:error] [pid 16709:tid 16712] [client 85.203.23.197:26565] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aRbQCaNdzfVNC4oipLUChAAAAUE"]
[Fri Nov 14 14:45:29.608084 2025] [:error] [pid 16709:tid 16718] [client 85.203.23.218:61981] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aRbQCaNdzfVNC4oipLUChgAAAUc"]
[Fri Nov 14 14:45:29.807428 2025] [:error] [pid 16573:tid 16595] [client 85.203.23.176:26943] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-trackback.php"] [unique_id "aRbQCSPGexfUk9FDoEJXEwAAAFE"]
[Fri Nov 14 14:45:30.009225 2025] [:error] [pid 16671:tid 16697] [client 85.203.23.192:20765] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aRbQCjsoHwEAmeIzZXALvgAAARQ"]
[Fri Nov 14 14:45:35.214687 2025] [:error] [pid 16709:tid 16716] [client 85.203.23.178:46391] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aRbQD6NdzfVNC4oipLUCmQAAAUU"]
[Fri Nov 14 14:45:35.413947 2025] [:error] [pid 16709:tid 16727] [client 85.203.23.204:53793] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/.well-known/acme-challenge/"] [unique_id "aRbQD6NdzfVNC4oipLUCmwAAAVA"]
[Fri Nov 14 14:45:35.612892 2025] [:error] [pid 16709:tid 16711] [client 85.203.23.214:65287] [client 85.203.23.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/packed.php"] [unique_id "aRbQD6NdzfVNC4oipLUCnQAAAUA"]
[Fri Nov 14 14:45:35.813321 2025] [:error] [pid 16573:tid 16579] [client 85.203.23.188:20787] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aRbQDyPGexfUk9FDoEJXGgAAAEE"]
[Fri Nov 14 14:45:36.009920 2025] [:error] [pid 16574:tid 16616] [client 85.203.23.209:25843] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/"] [unique_id "aRbQEP6XQqe4NqaoE9L3FwAAAIk"]
[Fri Nov 14 14:45:36.215821 2025] [:error] [pid 16575:tid 16647] [client 85.203.23.222:55509] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ini.php"] [unique_id "aRbQEO6qT670YxigvbBEywAAAM0"]
[Fri Nov 14 14:45:41.335494 2025] [:error] [pid 16573:tid 16581] [client 85.203.23.215:25875] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/index/function.php"] [unique_id "aRbQFSPGexfUk9FDoEJXHQAAAEM"]
[Fri Nov 14 14:45:41.514927 2025] [:error] [pid 16575:tid 16638] [client 85.203.23.223:20601] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aRbQFe6qT670YxigvbBE0AAAAMQ"]
[Fri Nov 14 14:45:41.711383 2025] [:error] [pid 16573:tid 16582] [client 85.203.23.204:47659] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-signin.php"] [unique_id "aRbQFSPGexfUk9FDoEJXHwAAAEQ"]
[Fri Nov 14 14:45:41.915439 2025] [:error] [pid 16671:tid 16693] [client 85.203.23.180:26527] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aRbQFTsoHwEAmeIzZXALwgAAARA"]
[Fri Nov 14 14:45:42.115191 2025] [:error] [pid 16575:tid 16634] [client 85.203.23.172:54049] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/login.php"] [unique_id "aRbQFu6qT670YxigvbBE0QAAAMA"]
[Fri Nov 14 14:45:42.321272 2025] [:error] [pid 16671:tid 16696] [client 85.203.23.200:45401] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/we.php"] [unique_id "aRbQFjsoHwEAmeIzZXALwwAAARM"]
[Fri Nov 14 14:45:42.510001 2025] [:error] [pid 16573:tid 16596] [client 85.203.23.187:39001] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/mah.php"] [unique_id "aRbQFiPGexfUk9FDoEJXIQAAAFI"]
[Fri Nov 14 14:45:42.710777 2025] [:error] [pid 16671:tid 16688] [client 85.203.23.217:28377] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/index.php"] [unique_id "aRbQFjsoHwEAmeIzZXALxQAAAQs"]
[Fri Nov 14 14:45:42.919445 2025] [:error] [pid 16573:tid 16590] [client 85.203.23.182:26303] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/as.php"] [unique_id "aRbQFiPGexfUk9FDoEJXIgAAAEw"]
[Fri Nov 14 14:45:43.205764 2025] [:error] [pid 16573:tid 16598] [client 85.203.23.218:21851] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/pwnd/block-support.php"] [unique_id "aRbQFyPGexfUk9FDoEJXJQAAAFQ"]
[Fri Nov 14 14:45:43.524209 2025] [:error] [pid 16575:tid 16636] [client 85.203.23.189:30055] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aRbQF-6qT670YxigvbBE0wAAAMI"]
[Fri Nov 14 14:45:43.712929 2025] [:error] [pid 16671:tid 16677] [client 85.203.23.189:54055] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/adminfuns.php"] [unique_id "aRbQFzsoHwEAmeIzZXALxwAAAQA"]
[Fri Nov 14 14:45:43.906264 2025] [:error] [pid 16573:tid 16585] [client 85.203.23.202:61967] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aRbQFyPGexfUk9FDoEJXJwAAAEc"]
[Fri Nov 14 14:45:44.112482 2025] [:error] [pid 16671:tid 16698] [client 85.203.23.214:39701] [client 85.203.23.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/"] [unique_id "aRbQGDsoHwEAmeIzZXALyQAAARU"]
[Fri Nov 14 14:45:44.312358 2025] [:error] [pid 16573:tid 16584] [client 85.203.23.202:47505] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/mini.php"] [unique_id "aRbQGCPGexfUk9FDoEJXKAAAAEY"]
[Fri Nov 14 14:45:44.509088 2025] [:error] [pid 16573:tid 16602] [client 85.203.23.180:60105] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/new.php"] [unique_id "aRbQGCPGexfUk9FDoEJXKQAAAFg"]
[Fri Nov 14 14:45:44.712970 2025] [:error] [pid 16575:tid 16640] [client 85.203.23.172:43125] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/buy.php"] [unique_id "aRbQGO6qT670YxigvbBE1QAAAMY"]
[Fri Nov 14 14:45:44.912293 2025] [:error] [pid 16575:tid 16656] [client 85.203.23.190:35099] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/f.php"] [unique_id "aRbQGO6qT670YxigvbBE1gAAANY"]
[Fri Nov 14 14:45:45.109446 2025] [:error] [pid 16575:tid 16649] [client 85.203.23.176:28463] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-header.php"] [unique_id "aRbQGe6qT670YxigvbBE1wAAAM8"]
[Fri Nov 14 14:45:45.308793 2025] [:error] [pid 16709:tid 16729] [client 85.203.23.185:25959] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bolt.php"] [unique_id "aRbQGaNdzfVNC4oipLUCpAAAAVI"]
[Fri Nov 14 14:45:50.512944 2025] [:error] [pid 16709:tid 16734] [client 85.203.23.188:62209] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/buy.php"] [unique_id "aRbQHqNdzfVNC4oipLUCqgAAAVc"]
[Fri Nov 14 14:45:50.720506 2025] [:error] [pid 16709:tid 16717] [client 85.203.23.186:42305] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/shell3.php"] [unique_id "aRbQHqNdzfVNC4oipLUCrAAAAUY"]
[Fri Nov 14 14:45:50.909689 2025] [:error] [pid 16671:tid 16692] [client 85.203.23.184:28813] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "aRbQHjsoHwEAmeIzZXALzgAAAQ8"]
[Fri Nov 14 14:45:51.110946 2025] [:error] [pid 16573:tid 16600] [client 85.203.23.214:23403] [client 85.203.23.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "aRbQHyPGexfUk9FDoEJXNAAAAFY"]
[Fri Nov 14 14:45:51.314707 2025] [:error] [pid 16573:tid 16579] [client 85.203.23.192:48991] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/covr-wpcom/assets/fonts/manrope.php"] [unique_id "aRbQHyPGexfUk9FDoEJXNQAAAEE"]
[Fri Nov 14 14:45:51.510860 2025] [:error] [pid 16573:tid 16589] [client 85.203.23.199:57433] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-conflg/function.php"] [unique_id "aRbQHyPGexfUk9FDoEJXNgAAAEs"]
[Fri Nov 14 14:45:51.713989 2025] [:error] [pid 16671:tid 16690] [client 85.203.23.190:23759] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/uploaded_script.php"] [unique_id "aRbQHzsoHwEAmeIzZXAL0AAAAQ0"]
[Fri Nov 14 14:45:51.909890 2025] [:error] [pid 16671:tid 16697] [client 85.203.23.183:40413] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aRbQHzsoHwEAmeIzZXAL0QAAARQ"]
[Fri Nov 14 14:45:52.111255 2025] [:error] [pid 16709:tid 16716] [client 85.203.23.208:49149] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/about/function.php"] [unique_id "aRbQIKNdzfVNC4oipLUCrwAAAUU"]
[Fri Nov 14 14:45:52.311856 2025] [:error] [pid 16671:tid 16677] [client 85.203.23.209:61949] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/admin.php"] [unique_id "aRbQIDsoHwEAmeIzZXAL1AAAAQA"]
[Fri Nov 14 14:45:52.510511 2025] [:error] [pid 16575:tid 16657] [client 85.203.23.172:47341] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/item.php"] [unique_id "aRbQIO6qT670YxigvbBE4QAAANc"]
[Fri Nov 14 14:45:52.713127 2025] [:error] [pid 16573:tid 16597] [client 85.203.23.183:26411] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aRbQICPGexfUk9FDoEJXNwAAAFM"]
[Fri Nov 14 14:45:53.034699 2025] [:error] [pid 16671:tid 16682] [client 85.203.23.201:35405] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/news-portal/error.php"] [unique_id "aRbQITsoHwEAmeIzZXAL1QAAAQU"]
[Fri Nov 14 14:45:58.225766 2025] [:error] [pid 16709:tid 16716] [client 85.203.23.178:27393] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/a.php"] [unique_id "aRbQJqNdzfVNC4oipLUCuAAAAUU"]
[Fri Nov 14 14:45:58.621610 2025] [:error] [pid 16709:tid 16729] [client 85.203.23.193:33845] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentyfive/include.php"] [unique_id "aRbQJqNdzfVNC4oipLUCuwAAAVI"]
[Fri Nov 14 14:45:58.824262 2025] [:error] [pid 16575:tid 16647] [client 85.203.23.217:25935] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/index2.php"] [unique_id "aRbQJu6qT670YxigvbBE5AAAAM0"]
[Fri Nov 14 14:45:59.009616 2025] [:error] [pid 16575:tid 16650] [client 85.203.23.208:59617] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/b.php"] [unique_id "aRbQJ-6qT670YxigvbBE5QAAANA"]
[Fri Nov 14 14:45:59.208933 2025] [:error] [pid 16709:tid 16728] [client 85.203.23.192:57139] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/options.php"] [unique_id "aRbQJ6NdzfVNC4oipLUCvQAAAVE"]
[Fri Nov 14 14:45:59.409854 2025] [:error] [pid 16574:tid 16618] [client 85.203.23.208:54303] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/s.php"] [unique_id "aRbQJ_6XQqe4NqaoE9L3LQAAAIs"]
[Fri Nov 14 14:45:59.612764 2025] [:error] [pid 16574:tid 16615] [client 85.203.23.203:46203] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/sunrise/index.php"] [unique_id "aRbQJ_6XQqe4NqaoE9L3LgAAAIg"]
[Fri Nov 14 14:45:59.814361 2025] [:error] [pid 16671:tid 16678] [client 85.203.23.168:61675] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aRbQJzsoHwEAmeIzZXAL4gAAAQE"]
[Fri Nov 14 14:46:00.010245 2025] [:error] [pid 16574:tid 16611] [client 85.203.23.177:27591] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aRbQKP6XQqe4NqaoE9L3MAAAAIQ"]
[Fri Nov 14 14:46:00.214390 2025] [:error] [pid 16575:tid 16657] [client 85.203.23.191:41495] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-conf.php"] [unique_id "aRbQKO6qT670YxigvbBE5gAAANc"]
[Fri Nov 14 14:46:00.422999 2025] [:error] [pid 16671:tid 16693] [client 85.203.23.173:36887] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/x.php"] [unique_id "aRbQKDsoHwEAmeIzZXAL5AAAARA"]
[Fri Nov 14 14:46:00.606506 2025] [:error] [pid 16573:tid 16593] [client 85.203.23.212:53153] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp.php"] [unique_id "aRbQKCPGexfUk9FDoEJXOQAAAE8"]
[Fri Nov 14 14:46:00.814469 2025] [:error] [pid 16573:tid 16601] [client 85.203.23.172:60003] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/class.php"] [unique_id "aRbQKCPGexfUk9FDoEJXOgAAAFc"]
[Fri Nov 14 14:46:01.008494 2025] [:error] [pid 16575:tid 16635] [client 85.203.23.191:63575] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-files.php"] [unique_id "aRbQKe6qT670YxigvbBE6AAAAME"]
[Fri Nov 14 14:46:01.212000 2025] [:error] [pid 16709:tid 16731] [client 85.203.23.225:21953] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/"] [unique_id "aRbQKaNdzfVNC4oipLUCwwAAAVQ"]
[Fri Nov 14 14:46:01.524947 2025] [:error] [pid 16575:tid 16642] [client 85.203.23.185:29257] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/admin.php"] [unique_id "aRbQKe6qT670YxigvbBE6QAAAMg"]
[Fri Nov 14 14:46:01.713331 2025] [:error] [pid 16575:tid 16655] [client 85.203.23.182:60883] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aRbQKe6qT670YxigvbBE6gAAANU"]
[Fri Nov 14 14:46:01.912236 2025] [:error] [pid 16709:tid 16715] [client 85.203.23.166:38893] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/db.php"] [unique_id "aRbQKaNdzfVNC4oipLUCxgAAAUQ"]
[Fri Nov 14 14:46:02.106860 2025] [:error] [pid 16575:tid 16636] [client 85.203.23.182:46983] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/m.php"] [unique_id "aRbQKu6qT670YxigvbBE7QAAAMI"]
[Fri Nov 14 14:46:02.309072 2025] [:error] [pid 16575:tid 16637] [client 85.203.23.168:59081] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/chosen.php"] [unique_id "aRbQKu6qT670YxigvbBE7wAAAMM"]
[Fri Nov 14 14:46:02.512846 2025] [:error] [pid 16671:tid 16691] [client 85.203.23.197:30931] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aRbQKjsoHwEAmeIzZXAL5gAAAQ4"]
[Fri Nov 14 14:46:02.714487 2025] [:error] [pid 16671:tid 16684] [client 85.203.23.212:42607] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bk/index.php"] [unique_id "aRbQKjsoHwEAmeIzZXAL6AAAAQc"]
[Fri Nov 14 14:46:02.915354 2025] [:error] [pid 16575:tid 16640] [client 85.203.23.184:42947] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/log.php"] [unique_id "aRbQKu6qT670YxigvbBE8AAAAMY"]
[Fri Nov 14 14:46:03.106512 2025] [:error] [pid 16575:tid 16656] [client 85.203.23.172:63137] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/navigation/index.php"] [unique_id "aRbQK-6qT670YxigvbBE8QAAANY"]
[Fri Nov 14 14:46:03.309686 2025] [:error] [pid 16574:tid 16612] [client 85.203.23.208:64813] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/"] [unique_id "aRbQK_6XQqe4NqaoE9L3MwAAAIU"]
[Fri Nov 14 14:46:03.511839 2025] [:error] [pid 16575:tid 16657] [client 85.203.23.223:36083] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/"] [unique_id "aRbQK-6qT670YxigvbBE8wAAANc"]
[Fri Nov 14 14:46:03.711465 2025] [:error] [pid 16575:tid 16643] [client 85.203.23.202:53127] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/post.php"] [unique_id "aRbQK-6qT670YxigvbBE9QAAAMk"]
[Fri Nov 14 14:46:03.906324 2025] [:error] [pid 16573:tid 16588] [client 85.203.23.199:51011] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/radio.php"] [unique_id "aRbQKyPGexfUk9FDoEJXPAAAAEo"]
[Fri Nov 14 14:46:04.218466 2025] [:error] [pid 16573:tid 16595] [client 85.203.23.220:42431] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/contact.php"] [unique_id "aRbQLCPGexfUk9FDoEJXPQAAAFE"]
[Fri Nov 14 14:46:04.417411 2025] [:error] [pid 16574:tid 16622] [client 85.203.23.209:29133] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aRbQLP6XQqe4NqaoE9L3NQAAAI8"]
[Fri Nov 14 14:46:04.615141 2025] [:error] [pid 16573:tid 16580] [client 85.203.23.185:47275] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/error.php"] [unique_id "aRbQLCPGexfUk9FDoEJXPgAAAEI"]
[Fri Nov 14 14:46:04.818102 2025] [:error] [pid 16574:tid 16618] [client 85.203.23.222:20393] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/lib/"] [unique_id "aRbQLP6XQqe4NqaoE9L3NwAAAIs"]
[Fri Nov 14 14:46:05.010662 2025] [:error] [pid 16573:tid 16581] [client 85.203.23.214:37407] [client 85.203.23.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/endpoints/"] [unique_id "aRbQLSPGexfUk9FDoEJXPwAAAEM"]
[Fri Nov 14 14:46:05.210379 2025] [:error] [pid 16574:tid 16630] [client 85.203.23.166:20161] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aRbQLf6XQqe4NqaoE9L3OAAAAJc"]
[Fri Nov 14 14:46:05.413156 2025] [:error] [pid 16573:tid 16591] [client 85.203.23.204:45467] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/leafmailer.php"] [unique_id "aRbQLSPGexfUk9FDoEJXQwAAAE0"]
[Fri Nov 14 14:46:05.626130 2025] [:error] [pid 16573:tid 16579] [client 85.203.23.187:47913] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/byp.php"] [unique_id "aRbQLSPGexfUk9FDoEJXRAAAAEE"]
[Fri Nov 14 14:46:05.821882 2025] [:error] [pid 16573:tid 16589] [client 85.203.23.202:63217] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/search/"] [unique_id "aRbQLSPGexfUk9FDoEJXRgAAAEs"]
[Fri Nov 14 14:46:06.016412 2025] [:error] [pid 16709:tid 16730] [client 85.203.23.192:63729] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aRbQLqNdzfVNC4oipLUCyAAAAVM"]
[Fri Nov 14 14:46:06.211060 2025] [:error] [pid 16573:tid 16585] [client 85.203.23.187:41003] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/images/index.php"] [unique_id "aRbQLiPGexfUk9FDoEJXSAAAAEc"]
[Fri Nov 14 14:46:06.424196 2025] [:error] [pid 16575:tid 16635] [client 85.203.23.211:55629] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/update/function.php"] [unique_id "aRbQLu6qT670YxigvbBE9gAAAME"]
[Fri Nov 14 14:46:06.609721 2025] [:error] [pid 16573:tid 16599] [client 85.203.23.211:21195] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/assets/"] [unique_id "aRbQLiPGexfUk9FDoEJXSQAAAFU"]
[Fri Nov 14 14:46:06.810727 2025] [:error] [pid 16709:tid 16725] [client 85.203.23.202:22215] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/menu.php"] [unique_id "aRbQLqNdzfVNC4oipLUCygAAAU4"]
[Fri Nov 14 14:46:07.022857 2025] [:error] [pid 16709:tid 16720] [client 85.203.23.217:42715] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aRbQL6NdzfVNC4oipLUCywAAAUk"]
[Fri Nov 14 14:46:07.212381 2025] [:error] [pid 16671:tid 16679] [client 85.203.23.193:27441] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/upload/"] [unique_id "aRbQLzsoHwEAmeIzZXAL7AAAAQI"]
[Fri Nov 14 14:46:07.414472 2025] [:error] [pid 16574:tid 16624] [client 85.203.23.172:54319] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/function/function.php"] [unique_id "aRbQL_6XQqe4NqaoE9L3OwAAAJE"]
[Fri Nov 14 14:46:07.616089 2025] [:error] [pid 16573:tid 16580] [client 85.203.23.225:58837] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/abcd.php"] [unique_id "aRbQLyPGexfUk9FDoEJXSgAAAEI"]
[Fri Nov 14 14:46:07.815439 2025] [:error] [pid 16573:tid 16581] [client 85.203.23.208:42489] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/manager.php"] [unique_id "aRbQLyPGexfUk9FDoEJXTAAAAEM"]
[Fri Nov 14 14:46:09.419710 2025] [:error] [pid 16573:tid 16591] [client 85.203.23.183:26437] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/about.php"] [unique_id "aRbQMSPGexfUk9FDoEJXTgAAAE0"]
[Fri Nov 14 14:46:09.618623 2025] [:error] [pid 16709:tid 16730] [client 85.203.23.171:55065] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/info.php"] [unique_id "aRbQMaNdzfVNC4oipLUC0QAAAVM"]
[Fri Nov 14 14:46:09.810632 2025] [:error] [pid 16709:tid 16711] [client 85.203.23.224:28907] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aRbQMaNdzfVNC4oipLUC0gAAAUA"]
[Fri Nov 14 14:46:10.016199 2025] [:error] [pid 16573:tid 16592] [client 85.203.23.195:41893] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aRbQMiPGexfUk9FDoEJXTwAAAE4"]
[Fri Nov 14 14:46:15.213461 2025] [:error] [pid 16709:tid 16730] [client 85.203.23.215:40879] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aRbQN6NdzfVNC4oipLUC3QAAAVM"]
[Fri Nov 14 14:46:15.409309 2025] [:error] [pid 16574:tid 16630] [client 85.203.23.183:50945] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aRbQN_6XQqe4NqaoE9L3PwAAAJc"]
[Fri Nov 14 14:46:15.625677 2025] [:error] [pid 16574:tid 16610] [client 85.203.23.211:25237] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/about.php"] [unique_id "aRbQN_6XQqe4NqaoE9L3QQAAAIM"]
[Fri Nov 14 14:46:15.810400 2025] [:error] [pid 16709:tid 16724] [client 85.203.23.191:24085] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/themes/"] [unique_id "aRbQN6NdzfVNC4oipLUC3gAAAU0"]
[Fri Nov 14 14:46:16.013663 2025] [:error] [pid 16575:tid 16644] [client 85.203.23.223:22025] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/2.php"] [unique_id "aRbQOO6qT670YxigvbBE9wAAAMo"]
[Fri Nov 14 14:46:16.214421 2025] [:error] [pid 16709:tid 16725] [client 85.203.23.200:38809] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/function.php"] [unique_id "aRbQOKNdzfVNC4oipLUC3wAAAU4"]
[Fri Nov 14 14:46:16.408109 2025] [:error] [pid 16575:tid 16645] [client 85.203.23.170:50075] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aRbQOO6qT670YxigvbBE-QAAAMs"]
[Fri Nov 14 14:46:16.627244 2025] [:error] [pid 16575:tid 16657] [client 85.203.23.183:56235] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/chosen/function.php"] [unique_id "aRbQOO6qT670YxigvbBE-gAAANc"]
[Fri Nov 14 14:46:16.815768 2025] [:error] [pid 16575:tid 16643] [client 85.203.23.205:31579] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/alfa.php"] [unique_id "aRbQOO6qT670YxigvbBE_AAAAMk"]
[Fri Nov 14 14:46:17.008859 2025] [:error] [pid 16709:tid 16713] [client 85.203.23.180:53971] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aRbQOaNdzfVNC4oipLUC4QAAAUI"]
[Fri Nov 14 14:46:17.212536 2025] [:error] [pid 16709:tid 16731] [client 85.203.23.209:35551] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aRbQOaNdzfVNC4oipLUC4gAAAVQ"]
[Fri Nov 14 14:46:17.419034 2025] [:error] [pid 16573:tid 16584] [client 85.203.23.205:32593] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/item.php"] [unique_id "aRbQOSPGexfUk9FDoEJXUQAAAEY"]
[Fri Nov 14 14:46:17.611064 2025] [:error] [pid 16573:tid 16580] [client 85.203.23.172:49403] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/crop/index.php"] [unique_id "aRbQOSPGexfUk9FDoEJXUgAAAEI"]
[Fri Nov 14 14:46:17.810604 2025] [:error] [pid 16575:tid 16638] [client 85.203.23.180:42157] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/include.php"] [unique_id "aRbQOe6qT670YxigvbBFAQAAAMQ"]
[Fri Nov 14 14:46:18.011434 2025] [:error] [pid 16574:tid 16626] [client 85.203.23.170:49255] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cgi-bin/user/index.php"] [unique_id "aRbQOv6XQqe4NqaoE9L3QgAAAJM"]
[Fri Nov 14 14:46:18.301716 2025] [:error] [pid 16574:tid 16609] [client 85.203.23.180:54045] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyfive/assets/fonts/beiruti/index.php"] [unique_id "aRbQOv6XQqe4NqaoE9L3QwAAAII"]
[Fri Nov 14 14:46:23.509951 2025] [:error] [pid 16575:tid 16651] [client 85.203.23.190:23629] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/config.php"] [unique_id "aRbQP-6qT670YxigvbBFEAAAANE"]
[Fri Nov 14 14:46:23.710602 2025] [:error] [pid 16575:tid 16656] [client 85.203.23.166:51309] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/xmrlpc.php"] [unique_id "aRbQP-6qT670YxigvbBFEgAAANY"]
[Fri Nov 14 14:46:23.907785 2025] [:error] [pid 16575:tid 16646] [client 85.203.23.166:43171] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyfour/patterns/wp-good.php"] [unique_id "aRbQP-6qT670YxigvbBFEwAAAMw"]
[Fri Nov 14 14:46:24.114825 2025] [:error] [pid 16575:tid 16639] [client 85.203.23.220:65367] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aRbQQO6qT670YxigvbBFFAAAAMU"]
[Fri Nov 14 14:46:24.310512 2025] [:error] [pid 16709:tid 16711] [client 85.203.23.171:39031] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "aRbQQKNdzfVNC4oipLUC6QAAAUA"]
[Fri Nov 14 14:46:24.521012 2025] [:error] [pid 16575:tid 16653] [client 85.203.23.211:28047] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-Owl.php"] [unique_id "aRbQQO6qT670YxigvbBFFwAAANM"]
[Fri Nov 14 14:46:24.707664 2025] [:error] [pid 16709:tid 16722] [client 85.203.23.171:48939] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/plugins/about.php"] [unique_id "aRbQQKNdzfVNC4oipLUC6gAAAUs"]
[Fri Nov 14 14:46:24.908796 2025] [:error] [pid 16575:tid 16648] [client 85.203.23.222:27969] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/click.php"] [unique_id "aRbQQO6qT670YxigvbBFGAAAAM4"]
[Fri Nov 14 14:46:25.113223 2025] [:error] [pid 16671:tid 16695] [client 85.203.23.191:51883] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cong.php"] [unique_id "aRbQQTsoHwEAmeIzZXAMBgAAARI"]
[Fri Nov 14 14:46:25.312958 2025] [:error] [pid 16671:tid 16692] [client 85.203.23.200:27333] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/html-api/"] [unique_id "aRbQQTsoHwEAmeIzZXAMBwAAAQ8"]
[Fri Nov 14 14:46:25.514474 2025] [:error] [pid 16671:tid 16678] [client 85.203.23.205:42827] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/themes.php"] [unique_id "aRbQQTsoHwEAmeIzZXAMCAAAAQE"]
[Fri Nov 14 14:46:25.714967 2025] [:error] [pid 16671:tid 16685] [client 85.203.23.190:49353] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/aa.php"] [unique_id "aRbQQTsoHwEAmeIzZXAMCQAAAQg"]
[Fri Nov 14 14:46:26.024714 2025] [:error] [pid 16575:tid 16637] [client 85.203.23.176:31609] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ss.php"] [unique_id "aRbQQu6qT670YxigvbBFGwAAAMM"]
[Fri Nov 14 14:46:26.323912 2025] [:error] [pid 16573:tid 16590] [client 85.203.23.223:43593] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aRbQQiPGexfUk9FDoEJXVgAAAEw"]
[Fri Nov 14 14:46:26.616336 2025] [:error] [pid 16573:tid 16589] [client 85.203.23.205:53785] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cc.php"] [unique_id "aRbQQiPGexfUk9FDoEJXVwAAAEs"]
[Fri Nov 14 14:46:26.810619 2025] [:error] [pid 16573:tid 16593] [client 85.203.23.196:41249] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/classwithtostring.php"] [unique_id "aRbQQiPGexfUk9FDoEJXWQAAAE8"]
[Fri Nov 14 14:46:27.013115 2025] [:error] [pid 16575:tid 16646] [client 85.203.23.170:60891] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aRbQQ-6qT670YxigvbBFHQAAAMw"]
[Fri Nov 14 14:46:27.215650 2025] [:error] [pid 16573:tid 16594] [client 85.203.23.202:61681] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wander.php"] [unique_id "aRbQQyPGexfUk9FDoEJXXAAAAFA"]
[Fri Nov 14 14:46:27.408347 2025] [:error] [pid 16573:tid 16584] [client 85.203.23.220:45891] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/version.php"] [unique_id "aRbQQyPGexfUk9FDoEJXXgAAAEY"]
[Fri Nov 14 14:46:27.611779 2025] [:error] [pid 16575:tid 16641] [client 85.203.23.197:25303] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/about.php"] [unique_id "aRbQQ-6qT670YxigvbBFHgAAAMc"]
[Fri Nov 14 14:46:27.808915 2025] [:error] [pid 16573:tid 16583] [client 85.203.23.211:26041] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/xx.php"] [unique_id "aRbQQyPGexfUk9FDoEJXYAAAAEU"]
[Fri Nov 14 14:46:33.016033 2025] [:error] [pid 16671:tid 16678] [client 85.203.23.222:28209] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/product.php"] [unique_id "aRbQSTsoHwEAmeIzZXAMEQAAAQE"]
[Fri Nov 14 14:46:33.210987 2025] [:error] [pid 16574:tid 16609] [client 85.203.23.172:59357] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/chosen.php"] [unique_id "aRbQSf6XQqe4NqaoE9L3TgAAAII"]
[Fri Nov 14 14:46:33.413745 2025] [:error] [pid 16709:tid 16723] [client 85.203.23.205:57397] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/elp.php"] [unique_id "aRbQSaNdzfVNC4oipLUC-gAAAUw"]
[Fri Nov 14 14:46:33.606697 2025] [:error] [pid 16671:tid 16686] [client 85.203.23.170:22543] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/yasnu.php"] [unique_id "aRbQSTsoHwEAmeIzZXAMFAAAAQk"]
[Fri Nov 14 14:46:33.820770 2025] [:error] [pid 16709:tid 16731] [client 85.203.23.202:21759] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/.well-known/"] [unique_id "aRbQSaNdzfVNC4oipLUC_AAAAVQ"]
[Fri Nov 14 14:46:39.022743 2025] [:error] [pid 16709:tid 16733] [client 85.203.23.186:55355] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "aRbQT6NdzfVNC4oipLUDCgAAAVY"]
[Fri Nov 14 14:46:39.208010 2025] [:error] [pid 16671:tid 16691] [client 85.203.23.212:40609] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/.well-known/pki-validation/index.php"] [unique_id "aRbQTzsoHwEAmeIzZXAMIAAAAQ4"]
[Fri Nov 14 14:46:39.413352 2025] [:error] [pid 16574:tid 16617] [client 85.203.23.166:53351] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aRbQT_6XQqe4NqaoE9L3UAAAAIo"]
[Fri Nov 14 14:46:39.614689 2025] [:error] [pid 16575:tid 16653] [client 85.203.23.196:22949] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/flower.php"] [unique_id "aRbQT-6qT670YxigvbBFKQAAANM"]
[Fri Nov 14 14:46:39.814446 2025] [:error] [pid 16575:tid 16654] [client 85.203.23.209:48503] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/plugins/directionality/index.php"] [unique_id "aRbQT-6qT670YxigvbBFKgAAANQ"]
[Fri Nov 14 14:46:40.011506 2025] [:error] [pid 16575:tid 16637] [client 85.203.23.214:20649] [client 85.203.23.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aRbQUO6qT670YxigvbBFKwAAAMM"]
[Fri Nov 14 14:46:40.209093 2025] [:error] [pid 16671:tid 16683] [client 85.203.23.171:30641] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/wp.php"] [unique_id "aRbQUDsoHwEAmeIzZXAMIgAAAQY"]
[Fri Nov 14 14:46:45.413370 2025] [:error] [pid 16573:tid 16584] [client 85.203.23.172:52001] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aRbQVSPGexfUk9FDoEJXeAAAAEY"]
[Fri Nov 14 14:46:45.614043 2025] [:error] [pid 16709:tid 16720] [client 85.203.23.193:53411] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/tinyfilemanager/tinyfilemanager.php"] [unique_id "aRbQVaNdzfVNC4oipLUDDwAAAUk"]
[Fri Nov 14 14:46:45.816464 2025] [:error] [pid 16574:tid 16629] [client 85.203.23.172:46129] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aRbQVf6XQqe4NqaoE9L3WAAAAJY"]
[Fri Nov 14 14:46:46.013305 2025] [:error] [pid 16573:tid 16599] [client 85.203.23.188:33437] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "aRbQViPGexfUk9FDoEJXegAAAFU"]
[Fri Nov 14 14:46:46.209341 2025] [:error] [pid 16573:tid 16596] [client 85.203.23.168:36977] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "aRbQViPGexfUk9FDoEJXewAAAFI"]
[Fri Nov 14 14:46:46.412402 2025] [:error] [pid 16573:tid 16581] [client 85.203.23.187:38701] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tiny.php"] [unique_id "aRbQViPGexfUk9FDoEJXfQAAAEM"]
[Fri Nov 14 16:21:43.327017 2025] [:error] [pid 16709:tid 16718] [client 15.235.145.161:64243] [client 15.235.145.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/postnews.php"] [unique_id "aRbml6NdzfVNC4oipLU0kQAAAUc"]
[Fri Nov 14 16:21:45.116015 2025] [:error] [pid 16573:tid 16589] [client 15.235.145.161:64382] [client 15.235.145.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/postnews.php"] [unique_id "aRbmmSPGexfUk9FDoEJ6ZwAAAEs"]
[Fri Nov 14 16:21:48.461874 2025] [:error] [pid 16709:tid 16726] [client 15.235.145.161:64545] [client 15.235.145.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/postnews.php"] [unique_id "aRbmnKNdzfVNC4oipLU0nwAAAU8"]
[Sat Nov 15 02:33:16.694990 2025] [:error] [pid 45995:tid 46017] [client 34.125.68.163:60044] [client 34.125.68.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "aRd17MfhZrb6EV4SvFvfAgAAAhE"]
[Sat Nov 15 11:17:06.233361 2025] [:error] [pid 20654:tid 20677] [client 15.156.60.74:51524] [client 15.156.60.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aRfwsncS7eC8vO76_yddeQAAA5Q"]
[Sat Nov 15 11:27:39.826400 2025] [:error] [pid 19959:tid 19978] [client 56.125.20.132:46524] [client 56.125.20.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "aRfzK8jejiTUP1-IawN3vwAAAYw"]
[Sat Nov 15 11:38:12.054484 2025] [:error] [pid 19961:tid 19993] [client 13.57.42.232:55006] [client 13.57.42.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aRf1pDar7Si-84EApVQxvAAAAcA"]
[Sat Nov 15 11:48:09.776001 2025] [:error] [pid 27997:tid 28009] [client 15.223.172.115:45126] [client 15.223.172.115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "aRf3-dpja_6cDxKbxFmKhwAAAMo"]
[Sat Nov 15 12:09:26.157653 2025] [:error] [pid 22765:tid 22775] [client 138.197.23.42:64536] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aRf89qbrQzjuZmPIWDae9QAAAoU"]
[Sat Nov 15 12:09:26.574460 2025] [:error] [pid 19961:tid 19995] [client 138.197.23.42:64704] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aRf89jar7Si-84EApVQ2XQAAAcI"]
[Sat Nov 15 12:09:26.998955 2025] [:error] [pid 20654:tid 20681] [client 138.197.23.42:64855] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aRf89ncS7eC8vO76_ydtoAAAA5g"]
[Sat Nov 15 12:09:27.427985 2025] [:error] [pid 27997:tid 28003] [client 138.197.23.42:65013] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aRf899pja_6cDxKbxFmOQwAAAMQ"]
[Sat Nov 15 12:09:27.848970 2025] [:error] [pid 27997:tid 28011] [client 138.197.23.42:65193] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aRf899pja_6cDxKbxFmOWQAAAMw"]
[Sat Nov 15 12:38:26.288156 2025] [:error] [pid 20346:tid 20355] [client 98.92.32.172:52854] [client 98.92.32.172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aRgDwp7hsydZdIoVTlvU4gAAAwY"]
[Sat Nov 15 12:44:15.759735 2025] [:error] [pid 20654:tid 20672] [client 35.181.45.213:47822] [client 35.181.45.213] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "aRgFH3cS7eC8vO76_yd44QAAA48"]
[Sat Nov 15 13:38:34.307101 2025] [:error] [pid 27997:tid 28016] [client 45.153.34.233:51346] [client 45.153.34.233] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aRgR2tpja_6cDxKbxFmg0AAAANE"]
[Sat Nov 15 15:44:31.440308 2025] [:error] [pid 27909:tid 27935] [client 193.32.249.162:41166] [client 193.32.249.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aRgvXyTfZ6B57n8HepUQzQAAABY"]
[Sat Nov 15 15:44:31.441650 2025] [:error] [pid 27909:tid 27932] [client 193.32.249.162:30330] [client 193.32.249.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aRgvXyTfZ6B57n8HepUQzgAAABM"]
[Sat Nov 15 17:07:01.419377 2025] [:error] [pid 27909:tid 27916] [client 104.234.19.148:62991] [client 104.234.19.148] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/txets.php"] [unique_id "aRhCtSTfZ6B57n8HepUdgQAAAAM"]
[Sat Nov 15 17:07:01.911317 2025] [:error] [pid 19961:tid 19996] [client 216.24.219.97:50463] [client 216.24.219.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/txets.php"] [unique_id "aRhCtTar7Si-84EApVRnEgAAAcM"]
[Sat Nov 15 17:07:02.402301 2025] [:error] [pid 22765:tid 22771] [client 216.24.219.35:21851] [client 216.24.219.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/txets.php"] [unique_id "aRhCtqbrQzjuZmPIWDbZfwAAAoM"]
[Sat Nov 15 20:26:26.978262 2025] [:error] [pid 20346:tid 20362] [client 45.134.79.103:63667] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aRhxcp7hsydZdIoVTltMxAAAAw0"]
[Sat Nov 15 20:26:27.615971 2025] [:error] [pid 22765:tid 22785] [client 45.134.79.103:63945] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aRhxc6brQzjuZmPIWDb-kQAAAo8"]
[Sat Nov 15 20:26:28.261108 2025] [:error] [pid 27911:tid 27991] [client 45.134.79.103:64165] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRhxdMGzUdrhGBIfiKR2AgAAAJc"]
[Sun Nov 16 00:56:28.101580 2025] [:error] [pid 22765:tid 22784] [client 206.189.44.128:25356] [client 206.189.44.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aRiwvKbrQzjuZmPIWDY1jQAAAo4"]
[Sun Nov 16 00:56:32.333536 2025] [:error] [pid 27997:tid 28003] [client 206.189.44.128:25468] [client 206.189.44.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aRiwwNpja_6cDxKbxFkMkAAAAMQ"]
[Sun Nov 16 18:48:03.090858 2025] [autoindex:error] [pid 34271:tid 34275] [client 155.94.163.116:56335] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Nov 17 02:54:30.670740 2025] [:error] [pid 55655:tid 55666] [client 104.28.214.122:47117] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/style.php"] [unique_id "aRod5iGT_hu1vaVuRSSQogAAAAc"]
[Mon Nov 17 02:54:31.137612 2025] [:error] [pid 55655:tid 55681] [client 104.28.214.122:47128] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/style.php"] [unique_id "aRod5yGT_hu1vaVuRSSQpAAAABY"]
[Mon Nov 17 18:21:31.408942 2025] [:error] [pid 15888:tid 15914] [client 159.26.107.92:46567] [client 159.26.107.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.26.107.92, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aRr3KwjAdDTBm4W3qW0nbwAAAdc"]
[Mon Nov 17 18:21:45.775717 2025] [:error] [pid 39449:tid 39463] [client 103.177.150.29:4662] [client 103.177.150.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.177.150.29, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aRr3OaUCymTA3MDfzLNDsQAAAAk"]
[Mon Nov 17 20:01:49.753155 2025] [:error] [pid 20913:tid 20931] [client 103.186.31.45:56188] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/style.php"] [unique_id "aRsOrekafGNeN3nY1bdbFwAAA1A"]
[Mon Nov 17 20:01:50.025615 2025] [:error] [pid 31419:tid 31421] [client 103.186.31.45:56226] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/style.php"] [unique_id "aRsOrgHQ5Sbp7elmDZiYswAAAoA"]
[Mon Nov 17 20:01:50.285006 2025] [:error] [pid 32753:tid 32773] [client 103.186.31.45:56279] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/style.php"] [unique_id "aRsOrk6YNqI5vkht922DGAAAA9E"]
[Mon Nov 17 20:01:50.539507 2025] [:error] [pid 39537:tid 39563] [client 103.186.31.45:56331] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/style.php"] [unique_id "aRsOroZRrh1pcrdcLB-9ZQAAANc"]
[Mon Nov 17 20:01:50.805488 2025] [:error] [pid 39537:tid 39558] [client 103.186.31.45:56458] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style.php"] [unique_id "aRsOroZRrh1pcrdcLB-9agAAANI"]
[Mon Nov 17 20:01:51.063815 2025] [:error] [pid 39449:tid 39462] [client 103.186.31.45:56547] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/chosen.php"] [unique_id "aRsOr6UCymTA3MDfzLNbxwAAAAg"]
[Mon Nov 17 20:01:51.319374 2025] [:error] [pid 32753:tid 32778] [client 103.186.31.45:56751] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "aRsOr06YNqI5vkht922DIgAAA9Y"]
[Mon Nov 17 20:01:51.570221 2025] [:error] [pid 32753:tid 32779] [client 103.186.31.45:56899] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/flower.php"] [unique_id "aRsOr06YNqI5vkht922DJQAAA9c"]
[Mon Nov 17 20:01:51.819245 2025] [:error] [pid 39449:tid 39469] [client 103.186.31.45:56950] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/gifclass.php"] [unique_id "aRsOr6UCymTA3MDfzLNbygAAAA8"]
[Mon Nov 17 20:01:52.081468 2025] [:error] [pid 39449:tid 39468] [client 103.186.31.45:57022] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bless.php"] [unique_id "aRsOsKUCymTA3MDfzLNbzwAAAA4"]
[Mon Nov 17 20:01:52.342350 2025] [:error] [pid 39451:tid 39517] [client 103.186.31.45:57077] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/class-t.api.php"] [unique_id "aRsOsOfgkqXTS0SO3fAipAAAAIk"]
[Mon Nov 17 20:01:52.594620 2025] [:error] [pid 39449:tid 39471] [client 103.186.31.45:57142] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/blurbs.php"] [unique_id "aRsOsKUCymTA3MDfzLNb4wAAABE"]
[Mon Nov 17 20:01:52.860771 2025] [:error] [pid 39449:tid 39459] [client 103.186.31.45:57195] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/akcc.php"] [unique_id "aRsOsKUCymTA3MDfzLNb7gAAAAU"]
[Mon Nov 17 20:01:53.123107 2025] [:error] [pid 65302:tid 65322] [client 103.186.31.45:57280] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/abcd.php"] [unique_id "aRsOsQPMSx2v85r8y7wDygAAAVI"]
[Mon Nov 17 20:01:53.393737 2025] [:error] [pid 32753:tid 32772] [client 103.186.31.45:57332] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/shelp.php"] [unique_id "aRsOsU6YNqI5vkht922DPAAAA9A"]
[Mon Nov 17 20:01:53.671100 2025] [:error] [pid 32753:tid 32768] [client 103.186.31.45:57387] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cord.php"] [unique_id "aRsOsU6YNqI5vkht922DSwAAA8w"]
[Mon Nov 17 20:01:53.933522 2025] [:error] [pid 20913:tid 20931] [client 103.186.31.45:57446] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/dex.php"] [unique_id "aRsOsekafGNeN3nY1bdbIQAAA1A"]
[Mon Nov 17 20:01:54.205384 2025] [:error] [pid 65302:tid 65305] [client 103.186.31.45:57507] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRsOsgPMSx2v85r8y7wD2AAAAUE"]
[Mon Nov 17 20:01:54.479684 2025] [:error] [pid 39451:tid 39509] [client 103.186.31.45:57561] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/file2.php"] [unique_id "aRsOsufgkqXTS0SO3fAitwAAAIE"]
[Mon Nov 17 20:01:54.753000 2025] [:error] [pid 20913:tid 20921] [client 103.186.31.45:57620] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/zwso.php"] [unique_id "aRsOsukafGNeN3nY1bdbIgAAA0Y"]
[Mon Nov 17 20:01:55.012192 2025] [:error] [pid 65302:tid 65314] [client 103.186.31.45:57668] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/zwso.php"] [unique_id "aRsOswPMSx2v85r8y7wD3wAAAUo"]
[Mon Nov 17 20:01:55.274080 2025] [:error] [pid 32753:tid 32759] [client 103.186.31.45:57724] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "aRsOs06YNqI5vkht922DdgAAA8M"]
[Mon Nov 17 20:01:55.515274 2025] [:error] [pid 32753:tid 32766] [client 103.186.31.45:57793] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bolt.php"] [unique_id "aRsOs06YNqI5vkht922DggAAA8o"]
[Mon Nov 17 20:01:55.759103 2025] [:error] [pid 39537:tid 39547] [client 103.186.31.45:57873] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/shlo.php"] [unique_id "aRsOs4ZRrh1pcrdcLB-9igAAAMc"]
[Mon Nov 17 20:01:56.003745 2025] [:error] [pid 32753:tid 32762] [client 103.186.31.45:57954] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/133.php"] [unique_id "aRsOtE6YNqI5vkht922DmgAAA8Y"]
[Mon Nov 17 20:01:56.262178 2025] [:error] [pid 32753:tid 32758] [client 103.186.31.45:58018] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ahax.php"] [unique_id "aRsOtE6YNqI5vkht922DrwAAA8I"]
[Mon Nov 17 20:01:56.521935 2025] [:error] [pid 31419:tid 31441] [client 103.186.31.45:58087] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/php8.php"] [unique_id "aRsOtAHQ5Sbp7elmDZiY5AAAApQ"]
[Mon Nov 17 20:01:56.765034 2025] [:error] [pid 39537:tid 39558] [client 103.186.31.45:58151] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/lufix1.php"] [unique_id "aRsOtIZRrh1pcrdcLB-9kgAAANI"]
[Mon Nov 17 20:01:57.010199 2025] [:error] [pid 39537:tid 39546] [client 103.186.31.45:58250] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/witmm.php"] [unique_id "aRsOtYZRrh1pcrdcLB-9kwAAAMY"]
[Mon Nov 17 20:01:57.266103 2025] [:error] [pid 65302:tid 65324] [client 103.186.31.45:58451] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "aRsOtQPMSx2v85r8y7wEBwAAAVQ"]
[Mon Nov 17 20:01:57.521965 2025] [:error] [pid 39451:tid 39522] [client 103.186.31.45:58555] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aRsOtefgkqXTS0SO3fAi3gAAAI4"]
[Mon Nov 17 20:01:57.781437 2025] [:error] [pid 65302:tid 65307] [client 103.186.31.45:58621] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/index.php"] [unique_id "aRsOtQPMSx2v85r8y7wEDAAAAUM"]
[Mon Nov 17 20:01:58.033655 2025] [:error] [pid 39451:tid 39528] [client 103.186.31.45:58681] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "aRsOtufgkqXTS0SO3fAi4QAAAJQ"]
[Mon Nov 17 20:01:58.278271 2025] [:error] [pid 31419:tid 31422] [client 103.186.31.45:58745] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/222.php"] [unique_id "aRsOtgHQ5Sbp7elmDZiY9AAAAoE"]
[Mon Nov 17 20:01:58.522952 2025] [:error] [pid 39537:tid 39544] [client 103.186.31.45:58794] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/files.php"] [unique_id "aRsOtoZRrh1pcrdcLB-9pAAAAMQ"]
[Mon Nov 17 20:01:58.761576 2025] [:error] [pid 65302:tid 65308] [client 103.186.31.45:58858] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-editor.php"] [unique_id "aRsOtgPMSx2v85r8y7wEKgAAAUQ"]
[Tue Nov 18 01:30:38.312371 2025] [:error] [pid 39189:tid 39212] [client 74.176.48.190:24565] [client 74.176.48.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "aRtbvpJJLi753QwyqGzcowAAAJM"]
[Tue Nov 18 01:31:48.104658 2025] [:error] [pid 39189:tid 39200] [client 74.176.48.190:24534] [client 74.176.48.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aRtcBJJJLi753QwyqGzdMAAAAIc"]
[Tue Nov 18 01:34:55.795920 2025] [:error] [pid 40562:tid 40627] [client 74.176.48.190:23857] [client 74.176.48.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/buy.php"] [unique_id "aRtcvx18kaCmPuHE4a8RWwAAAUQ"]
[Tue Nov 18 01:36:42.945217 2025] [:error] [pid 40562:tid 40647] [client 74.176.48.190:23853] [client 74.176.48.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "aRtdKh18kaCmPuHE4a8SQgAAAVg"]
[Tue Nov 18 01:40:54.530437 2025] [:error] [pid 40793:tid 40854] [client 74.176.48.190:23745] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "aRteJgzccxeNeH-NUVgyoAAAAEQ"]
[Tue Nov 18 01:40:55.594257 2025] [:error] [pid 40553:tid 40571] [client 74.176.48.190:23584] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "aRteJ9uLE1BqoX0RcsLs3wAAAAM"]
[Tue Nov 18 01:40:57.625649 2025] [:error] [pid 40553:tid 40587] [client 74.176.48.190:23757] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "aRteKduLE1BqoX0RcsLs5QAAABI"]
[Tue Nov 18 01:41:03.492267 2025] [:error] [pid 40553:tid 40576] [client 74.176.48.190:23860] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/great.php"] [unique_id "aRteL9uLE1BqoX0RcsLs7AAAAAc"]
[Tue Nov 18 01:41:04.254821 2025] [:error] [pid 40553:tid 40587] [client 74.176.48.190:23834] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/great.php"] [unique_id "aRteMNuLE1BqoX0RcsLs7gAAABI"]
[Tue Nov 18 01:41:06.404998 2025] [:error] [pid 39189:tid 39208] [client 74.176.48.190:23784] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/great.php"] [unique_id "aRteMpJJLi753QwyqGzh5AAAAI8"]
[Tue Nov 18 01:41:08.291985 2025] [:error] [pid 40562:tid 40627] [client 74.176.48.190:23776] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/great.php"] [unique_id "aRteNB18kaCmPuHE4a8TugAAAUQ"]
[Tue Nov 18 01:41:09.199284 2025] [:error] [pid 40793:tid 40861] [client 74.176.48.190:23864] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fifii.php"] [unique_id "aRteNQzccxeNeH-NUVgytAAAAEs"]
[Tue Nov 18 01:41:10.511389 2025] [:error] [pid 40793:tid 40871] [client 74.176.48.190:23744] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fifii.php"] [unique_id "aRteNgzccxeNeH-NUVgytQAAAFU"]
[Tue Nov 18 01:41:12.879880 2025] [:error] [pid 39189:tid 39208] [client 74.176.48.190:23777] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fifii.php"] [unique_id "aRteOJJJLi753QwyqGzh9AAAAI8"]
[Tue Nov 18 01:41:16.935718 2025] [:error] [pid 40562:tid 40625] [client 74.176.48.190:23857] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fifii.php"] [unique_id "aRtePB18kaCmPuHE4a8TwgAAAUI"]
[Tue Nov 18 01:41:20.903641 2025] [:error] [pid 40553:tid 40569] [client 74.176.48.190:23867] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/12.php"] [unique_id "aRteQNuLE1BqoX0RcsLs_gAAAAE"]
[Tue Nov 18 01:41:29.779453 2025] [:error] [pid 40562:tid 40641] [client 74.176.48.190:23794] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/12.php"] [unique_id "aRteSR18kaCmPuHE4a8T_QAAAVI"]
[Tue Nov 18 01:41:31.712656 2025] [:error] [pid 40793:tid 40855] [client 74.176.48.190:23831] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/12.php"] [unique_id "aRteSwzccxeNeH-NUVgy4gAAAEU"]
[Tue Nov 18 01:41:35.160052 2025] [:error] [pid 40561:tid 40596] [client 74.176.48.190:23838] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/efile.php"] [unique_id "aRteT5dU597fIdQPRD_FWAAAAMA"]
[Tue Nov 18 01:41:38.079443 2025] [:error] [pid 40553:tid 40572] [client 74.176.48.190:23754] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/efile.php"] [unique_id "aRteUtuLE1BqoX0RcsLtQgAAAAQ"]
[Tue Nov 18 01:41:41.035134 2025] [:error] [pid 39189:tid 39203] [client 74.176.48.190:23763] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/efile.php"] [unique_id "aRteVZJJLi753QwyqGziPAAAAIo"]
[Tue Nov 18 01:41:43.392404 2025] [:error] [pid 39189:tid 39205] [client 74.176.48.190:23823] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/efile.php"] [unique_id "aRteV5JJLi753QwyqGziRQAAAIw"]
[Tue Nov 18 01:41:46.433727 2025] [:error] [pid 39189:tid 39200] [client 74.176.48.190:23555] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/past1.php"] [unique_id "aRteWpJJLi753QwyqGziTQAAAIc"]
[Tue Nov 18 01:41:48.468298 2025] [:error] [pid 40553:tid 40570] [client 74.176.48.190:23778] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/past1.php"] [unique_id "aRteXNuLE1BqoX0RcsLtTwAAAAI"]
[Tue Nov 18 01:43:04.214940 2025] [:error] [pid 40553:tid 40576] [client 74.176.48.190:23605] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/new4.php"] [unique_id "aRteqNuLE1BqoX0RcsLtswAAAAc"]
[Tue Nov 18 01:43:09.375416 2025] [:error] [pid 40562:tid 40635] [client 74.176.48.190:23791] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/new4.php"] [unique_id "aRterR18kaCmPuHE4a8UhAAAAUw"]
[Tue Nov 18 01:43:10.613906 2025] [:error] [pid 40562:tid 40627] [client 74.176.48.190:23781] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/new4.php"] [unique_id "aRterh18kaCmPuHE4a8UiAAAAUQ"]
[Tue Nov 18 01:43:12.444228 2025] [:error] [pid 40561:tid 40620] [client 74.176.48.190:23814] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/new4.php"] [unique_id "aRtesJdU597fIdQPRD_F_AAAANg"]
[Tue Nov 18 01:43:14.737620 2025] [:error] [pid 40561:tid 40612] [client 74.176.48.190:23759] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wsr2.php"] [unique_id "aRtespdU597fIdQPRD_GAwAAANA"]
[Tue Nov 18 01:43:23.599592 2025] [:error] [pid 40793:tid 40871] [client 74.176.48.190:23810] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wsr2.php"] [unique_id "aRteuwzccxeNeH-NUVgzrAAAAFU"]
[Tue Nov 18 01:43:26.676871 2025] [:error] [pid 39189:tid 39194] [client 74.176.48.190:23842] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wsr2.php"] [unique_id "aRtevpJJLi753QwyqGzjVAAAAIE"]
[Tue Nov 18 01:43:28.222067 2025] [:error] [pid 39189:tid 39193] [client 74.176.48.190:23790] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/shlo.php"] [unique_id "aRtewJJJLi753QwyqGzjXAAAAIA"]
[Tue Nov 18 01:43:31.831515 2025] [:error] [pid 40562:tid 40645] [client 74.176.48.190:23766] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/shlo.php"] [unique_id "aRtewx18kaCmPuHE4a8UqgAAAVY"]
[Tue Nov 18 01:43:33.546341 2025] [:error] [pid 40561:tid 40608] [client 74.176.48.190:23557] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/shlo.php"] [unique_id "aRtexZdU597fIdQPRD_GJwAAAMw"]
[Tue Nov 18 01:43:36.362008 2025] [:error] [pid 39189:tid 39210] [client 74.176.48.190:23825] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/shlo.php"] [unique_id "aRteyJJJLi753QwyqGzjcAAAAJE"]
[Tue Nov 18 01:43:39.735636 2025] [:error] [pid 40553:tid 40591] [client 74.176.48.190:23770] [client 74.176.48.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/CLA.php"] [unique_id "aRtey9uLE1BqoX0RcsLt0gAAABY"]
[Tue Nov 18 14:16:36.592087 2025] [:error] [pid 44472:tid 44537] [client 94.32.99.173:53954] [client 94.32.99.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.32.99.173, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aRwPRIKhGwkiLjv8BQydGAAAAUY"]
[Tue Nov 18 21:18:25.873274 2025] [:error] [pid 44472:tid 44540] [client 84.247.191.22:51968] [client 84.247.191.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/"] [unique_id "aRxyIYKhGwkiLjv8BQwZ5gAAAUk"], referer: binance.com
[Tue Nov 18 21:37:30.980801 2025] [:error] [pid 1387:tid 1414] [client 45.134.79.103:49594] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aRx2mkzBvalKyx3hMvWeogAAABU"]
[Tue Nov 18 21:37:31.671602 2025] [:error] [pid 44470:tid 44485] [client 45.134.79.103:56917] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aRx2mzv-RLYfULjlgDb_WQAAAEo"]
[Tue Nov 18 21:37:32.342251 2025] [:error] [pid 3500:tid 3504] [client 45.134.79.103:52150] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRx2nPCbRC7k2D7mjbST4QAAAcI"]
[Wed Nov 19 07:30:38.442278 2025] [:error] [pid 6556:tid 6624] [client 18.191.165.250:56443] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aR0BnpuL7hhgrmdM1mt7GQAAAIY"]
[Wed Nov 19 07:30:38.839437 2025] [:error] [pid 6556:tid 6619] [client 18.191.165.250:56541] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aR0BnpuL7hhgrmdM1mt7JwAAAIE"]
[Wed Nov 19 07:30:39.231938 2025] [:error] [pid 6919:tid 6944] [client 18.191.165.250:56697] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aR0Bn0YFdN1s_9xJVUmrGwAAARY"]
[Wed Nov 19 07:30:39.625562 2025] [:error] [pid 6919:tid 6928] [client 18.191.165.250:56778] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aR0Bn0YFdN1s_9xJVUmrOwAAAQY"]
[Wed Nov 19 07:30:40.017257 2025] [:error] [pid 26664:tid 26671] [client 18.191.165.250:56858] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aR0BoIpWc1yoj2P7MeAR_gAAAUQ"]
[Wed Nov 19 08:38:55.796959 2025] [:error] [pid 6555:tid 6597] [client 179.135.15.235:62545] [client 179.135.15.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.135.15.235, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aR0Rn0bVJm8eMsGMTCOerAAAAEY"]
[Wed Nov 19 08:41:44.068834 2025] [:error] [pid 6644:tid 6656] [client 223.233.69.226:8991] [client 223.233.69.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.233.69.226, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aR0SSE0i6Rf788MB6sbvAAAAAMo"]
[Wed Nov 19 20:35:57.856623 2025] [:error] [pid 12672:tid 12677] [client 104.196.176.201:58198] [client 104.196.176.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/media/system/js/core.js"] [unique_id "aR25rf9vojl6X1cc5mUuzgAAAcA"]
[Thu Nov 20 01:41:28.110299 2025] [autoindex:error] [pid 50223:tid 50353] [client 157.173.101.17:65364] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Nov 20 10:49:18.807969 2025] [:error] [pid 804:tid 833] [client 89.185.82.43:58556] [client 89.185.82.43] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "aR6BrvaRHpUlPL9O0LknIwAAAYk"]
[Thu Nov 20 12:10:21.827525 2025] [:error] [pid 34444:tid 34450] [client 98.81.111.26:50435] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aR6UrVNEol4jlmmA_GPw4gAAAUQ"]
[Thu Nov 20 12:10:22.238603 2025] [:error] [pid 55343:tid 55415] [client 98.81.111.26:64886] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aR6UrlWlO3EnyVMV7w5lGwAAAJA"]
[Thu Nov 20 12:10:22.653651 2025] [:error] [pid 55430:tid 55447] [client 98.81.111.26:58120] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aR6UrvPZXaIMEU4pE7ug0QAAAM4"]
[Thu Nov 20 12:10:23.061619 2025] [:error] [pid 34405:tid 34428] [client 98.81.111.26:58887] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aR6UrzFpvu8oRK7ATfvJVAAAARU"]
[Thu Nov 20 12:15:51.324222 2025] [:error] [pid 55430:tid 55455] [client 98.81.111.26:53203] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aR6V9_PZXaIMEU4pE7umAwAAANY"]
[Thu Nov 20 12:15:51.732857 2025] [:error] [pid 55340:tid 55362] [client 98.81.111.26:56855] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aR6V9_OxD-NeMydTybBNVgAAABE"]
[Thu Nov 20 12:15:52.137844 2025] [:error] [pid 34444:tid 34469] [client 98.81.111.26:60392] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aR6V-FNEol4jlmmA_GP0kwAAAVc"]
[Thu Nov 20 12:15:52.542613 2025] [:error] [pid 55340:tid 55351] [client 98.81.111.26:62965] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aR6V-POxD-NeMydTybBNcAAAAAY"]
[Thu Nov 20 12:15:52.951192 2025] [:error] [pid 55343:tid 55408] [client 98.81.111.26:65068] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aR6V-FWlO3EnyVMV7w5owQAAAIk"]
[Thu Nov 20 16:09:45.376428 2025] [:error] [pid 40415:tid 40442] [client 172.161.90.19:29686] [client 172.161.90.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "aR7MyahjIyLSv09svwODcwAAAdg"]
[Thu Nov 20 18:56:50.900764 2025] [:error] [pid 55340:tid 55366] [client 20.27.30.201:22491] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aR7z8vOxD-NeMydTybCfewAAABU"]
[Thu Nov 20 18:56:52.478369 2025] [:error] [pid 40636:tid 40647] [client 20.27.30.201:22466] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aR7z9AK8BWUoW3xq0HAPJAAAA4c"]
[Thu Nov 20 18:56:53.112431 2025] [:error] [pid 40508:tid 40529] [client 20.27.30.201:22499] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aR7z9axXNVCMW_ksxPusrgAAApM"]
[Thu Nov 20 18:56:54.088898 2025] [:error] [pid 40508:tid 40533] [client 20.27.30.201:22405] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aR7z9qxXNVCMW_ksxPussAAAApc"]
[Thu Nov 20 20:15:05.303717 2025] [:error] [pid 34405:tid 34407] [client 4.217.160.29:6129] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/faq.php"] [unique_id "aR8GSTFpvu8oRK7ATfsr9QAAAQA"]
[Thu Nov 20 20:15:07.311182 2025] [:error] [pid 40636:tid 40640] [client 4.217.160.29:6089] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/faq.php"] [unique_id "aR8GSwK8BWUoW3xq0HAdHQAAA4A"]
[Thu Nov 20 20:15:16.091562 2025] [:error] [pid 55342:tid 55373] [client 4.217.160.29:6084] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/faq.php"] [unique_id "aR8GVLg6x32Tvk7fIG_wawAAAEE"]
[Thu Nov 20 20:15:17.788800 2025] [:error] [pid 40537:tid 40564] [client 4.217.160.29:6035] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/faq.php"] [unique_id "aR8GVaKlsL5kxTa3c1zyeQAAAtc"]
[Thu Nov 20 20:15:18.472670 2025] [:error] [pid 55342:tid 55389] [client 4.217.160.29:6126] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ffile.php"] [unique_id "aR8GVrg6x32Tvk7fIG_wbAAAAFE"]
[Thu Nov 20 20:15:24.599474 2025] [:error] [pid 55430:tid 55446] [client 4.217.160.29:6132] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ffile.php"] [unique_id "aR8GXPPZXaIMEU4pE7sQogAAAM0"]
[Thu Nov 20 20:15:25.916254 2025] [:error] [pid 40415:tid 40432] [client 4.217.160.29:6107] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ffile.php"] [unique_id "aR8GXahjIyLSv09svwO8OQAAAc4"]
[Thu Nov 20 20:15:29.865788 2025] [:error] [pid 40445:tid 40486] [client 4.217.160.29:6111] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ffile.php"] [unique_id "aR8GYVH-MuFcoWRjXpZ10QAAAks"]
[Thu Nov 20 20:15:33.163999 2025] [:error] [pid 55343:tid 55411] [client 4.217.160.29:6028] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "aR8GZVWlO3EnyVMV7w7BVAAAAIw"]
[Thu Nov 20 20:15:36.609831 2025] [:error] [pid 40508:tid 40528] [client 4.217.160.29:6123] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "aR8GaKxXNVCMW_ksxPvFoQAAApI"]
[Thu Nov 20 20:15:38.640375 2025] [:error] [pid 40445:tid 40489] [client 4.217.160.29:6104] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "aR8GalH-MuFcoWRjXpZ13AAAAk4"]
[Thu Nov 20 20:15:42.330219 2025] [:error] [pid 55343:tid 55405] [client 4.217.160.29:6074] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "aR8GblWlO3EnyVMV7w7BWQAAAIY"]
[Thu Nov 20 20:15:46.364804 2025] [:error] [pid 40445:tid 40493] [client 4.217.160.29:6119] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/file17.php"] [unique_id "aR8GclH-MuFcoWRjXpZ14wAAAlI"]
[Thu Nov 20 20:15:48.684259 2025] [:error] [pid 40636:tid 40651] [client 4.217.160.29:6128] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/file17.php"] [unique_id "aR8GdAK8BWUoW3xq0HAdPAAAA4s"]
[Thu Nov 20 20:15:50.207205 2025] [:error] [pid 55343:tid 55404] [client 4.217.160.29:6038] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/file17.php"] [unique_id "aR8GdlWlO3EnyVMV7w7BXgAAAIU"]
[Thu Nov 20 20:15:51.730641 2025] [:error] [pid 40415:tid 40420] [client 4.217.160.29:6139] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/file17.php"] [unique_id "aR8Gd6hjIyLSv09svwO8SwAAAcI"]
[Thu Nov 20 20:16:15.096267 2025] [:error] [pid 40445:tid 40478] [client 4.217.160.29:6048] [client 4.217.160.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "aR8Gj1H-MuFcoWRjXpZ1-gAAAkM"]
[Thu Nov 20 20:16:52.317845 2025] [:error] [pid 40415:tid 40439] [client 4.217.160.29:6086] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ot.php"] [unique_id "aR8GtKhjIyLSv09svwO8owAAAdU"]
[Thu Nov 20 20:16:57.594355 2025] [:error] [pid 40508:tid 40526] [client 4.217.160.29:6076] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ot.php"] [unique_id "aR8GuaxXNVCMW_ksxPvGCwAAApA"]
[Thu Nov 20 20:16:58.360481 2025] [:error] [pid 40508:tid 40520] [client 4.217.160.29:6047] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ot.php"] [unique_id "aR8GuqxXNVCMW_ksxPvGDAAAAoo"]
[Thu Nov 20 20:17:08.054740 2025] [:error] [pid 40537:tid 40550] [client 4.217.160.29:6131] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/past.php"] [unique_id "aR8GxKKlsL5kxTa3c1zytQAAAsk"]
[Thu Nov 20 20:17:08.726851 2025] [:error] [pid 55340:tid 55351] [client 4.217.160.29:5955] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/past.php"] [unique_id "aR8GxPOxD-NeMydTybCu4wAAAAY"]
[Thu Nov 20 20:17:10.490778 2025] [:error] [pid 55343:tid 55416] [client 4.217.160.29:5962] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/past.php"] [unique_id "aR8GxlWlO3EnyVMV7w7BxAAAAJE"]
[Thu Nov 20 20:17:11.792064 2025] [:error] [pid 40415:tid 40425] [client 4.217.160.29:6061] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/past.php"] [unique_id "aR8Gx6hjIyLSv09svwO8sQAAAcc"]
[Thu Nov 20 20:17:16.109283 2025] [:error] [pid 40415:tid 40438] [client 4.217.160.29:5958] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/pepe.php"] [unique_id "aR8GzKhjIyLSv09svwO8swAAAdQ"]
[Thu Nov 20 20:17:18.411173 2025] [:error] [pid 55343:tid 55409] [client 4.217.160.29:5960] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/pepe.php"] [unique_id "aR8GzlWlO3EnyVMV7w7B0wAAAIo"]
[Thu Nov 20 20:17:21.025537 2025] [:error] [pid 40445:tid 40498] [client 4.217.160.29:6027] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/pepe.php"] [unique_id "aR8G0VH-MuFcoWRjXpZ2wgAAAlc"]
[Thu Nov 20 20:17:23.577593 2025] [:error] [pid 40508:tid 40527] [client 4.217.160.29:6127] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/pepe.php"] [unique_id "aR8G06xXNVCMW_ksxPvGGwAAApE"]
[Thu Nov 20 20:17:27.766343 2025] [:error] [pid 55342:tid 55391] [client 4.217.160.29:6042] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/pp.php"] [unique_id "aR8G17g6x32Tvk7fIG_xJQAAAFM"]
[Thu Nov 20 20:17:31.382897 2025] [:error] [pid 55340:tid 55347] [client 4.217.160.29:6117] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/pp.php"] [unique_id "aR8G2_OxD-NeMydTybCu9gAAAAI"]
[Thu Nov 20 20:17:34.253420 2025] [:error] [pid 40445:tid 40495] [client 4.217.160.29:6050] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/pp.php"] [unique_id "aR8G3lH-MuFcoWRjXpZ2zAAAAlQ"]
[Thu Nov 20 20:17:37.389400 2025] [:error] [pid 55430:tid 55451] [client 4.217.160.29:5979] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/pp.php"] [unique_id "aR8G4fPZXaIMEU4pE7sQ6gAAANI"]
[Thu Nov 20 20:17:41.122993 2025] [:error] [pid 55343:tid 55399] [client 4.217.160.29:6091] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/re.php"] [unique_id "aR8G5VWlO3EnyVMV7w7B6wAAAIA"]
[Thu Nov 20 20:17:45.770571 2025] [:error] [pid 40508:tid 40528] [client 4.217.160.29:6078] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/re.php"] [unique_id "aR8G6axXNVCMW_ksxPvGRAAAApI"]
[Thu Nov 20 20:17:49.215229 2025] [:error] [pid 40445:tid 40493] [client 4.217.160.29:6142] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/re.php"] [unique_id "aR8G7VH-MuFcoWRjXpZ22AAAAlI"]
[Thu Nov 20 20:18:07.613758 2025] [:error] [pid 40508:tid 40529] [client 4.217.160.29:6087] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-logiin.php"] [unique_id "aR8G_6xXNVCMW_ksxPvGVAAAApM"]
[Thu Nov 20 20:18:08.650379 2025] [:error] [pid 40415:tid 40440] [client 4.217.160.29:5952] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-logiin.php"] [unique_id "aR8HAKhjIyLSv09svwO9BgAAAdY"]
[Thu Nov 20 20:18:09.571675 2025] [:error] [pid 40445:tid 40493] [client 4.217.160.29:5961] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-logiin.php"] [unique_id "aR8HAVH-MuFcoWRjXpZ25gAAAlI"]
[Thu Nov 20 20:18:11.095853 2025] [:error] [pid 55430:tid 55438] [client 4.217.160.29:6016] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-logiin.php"] [unique_id "aR8HA_PZXaIMEU4pE7sQ_AAAAMU"]
[Thu Nov 20 20:18:12.361188 2025] [:error] [pid 40445:tid 40480] [client 4.217.160.29:6113] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-mn.php"] [unique_id "aR8HBFH-MuFcoWRjXpZ26gAAAkU"]
[Thu Nov 20 20:18:15.657244 2025] [:error] [pid 55342:tid 55391] [client 4.217.160.29:6120] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-mn.php"] [unique_id "aR8HB7g6x32Tvk7fIG_xTwAAAFM"]
[Thu Nov 20 20:18:16.456025 2025] [:error] [pid 55342:tid 55394] [client 4.217.160.29:5973] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-mn.php"] [unique_id "aR8HCLg6x32Tvk7fIG_xUAAAAFY"]
[Thu Nov 20 20:18:17.311770 2025] [:error] [pid 40445:tid 40495] [client 4.217.160.29:6051] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-mn.php"] [unique_id "aR8HCVH-MuFcoWRjXpZ29wAAAlQ"]
[Thu Nov 20 20:18:18.991124 2025] [:error] [pid 55340:tid 55356] [client 4.217.160.29:6053] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-update.php"] [unique_id "aR8HCvOxD-NeMydTybCvMAAAAAs"]
[Thu Nov 20 20:18:19.833271 2025] [:error] [pid 40508:tid 40526] [client 4.217.160.29:6020] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-update.php"] [unique_id "aR8HC6xXNVCMW_ksxPvGXQAAApA"]
[Thu Nov 20 20:18:22.124321 2025] [:error] [pid 40445:tid 40483] [client 4.217.160.29:6037] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-update.php"] [unique_id "aR8HDlH-MuFcoWRjXpZ3AAAAAkg"]
[Thu Nov 20 20:18:25.282050 2025] [:error] [pid 34405:tid 34415] [client 4.217.160.29:5953] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-update.php"] [unique_id "aR8HETFpvu8oRK7ATfssjQAAAQg"]
[Thu Nov 20 20:18:26.529245 2025] [:error] [pid 34405:tid 34418] [client 4.217.160.29:5969] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wsa.php"] [unique_id "aR8HEjFpvu8oRK7ATfsskgAAAQs"]
[Thu Nov 20 20:18:38.059247 2025] [:error] [pid 55343:tid 55415] [client 4.217.160.29:6133] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wsa.php"] [unique_id "aR8HHlWlO3EnyVMV7w7B_AAAAJA"]
[Thu Nov 20 20:18:44.608081 2025] [:error] [pid 55342:tid 55396] [client 4.217.160.29:6134] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xl.php"] [unique_id "aR8HJLg6x32Tvk7fIG_xaQAAAFg"]
[Thu Nov 20 20:18:50.452436 2025] [:error] [pid 40445:tid 40485] [client 4.217.160.29:6092] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xl.php"] [unique_id "aR8HKlH-MuFcoWRjXpZ3IAAAAko"]
[Thu Nov 20 20:18:53.530099 2025] [:error] [pid 40537:tid 40554] [client 4.217.160.29:6033] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xl.php"] [unique_id "aR8HLaKlsL5kxTa3c1zy9QAAAs0"]
[Thu Nov 20 20:18:54.959707 2025] [:error] [pid 55342:tid 55396] [client 4.217.160.29:6112] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xl.php"] [unique_id "aR8HLrg6x32Tvk7fIG_xeQAAAFg"]
[Thu Nov 20 20:18:58.255736 2025] [:error] [pid 55340:tid 55358] [client 4.217.160.29:5889] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/z.php"] [unique_id "aR8HMvOxD-NeMydTybCvRgAAAA0"]
[Thu Nov 20 20:19:00.271329 2025] [:error] [pid 40445:tid 40475] [client 4.217.160.29:5972] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/z.php"] [unique_id "aR8HNFH-MuFcoWRjXpZ3NgAAAkA"]
[Thu Nov 20 20:19:01.125186 2025] [:error] [pid 55430:tid 55435] [client 4.217.160.29:6031] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/z.php"] [unique_id "aR8HNfPZXaIMEU4pE7sRGQAAAMI"]
[Thu Nov 20 20:19:03.352378 2025] [:error] [pid 55430:tid 55440] [client 4.217.160.29:6036] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/z.php"] [unique_id "aR8HN_PZXaIMEU4pE7sRHQAAAMc"]
[Fri Nov 21 03:45:38.111595 2025] [:error] [pid 33420:tid 33508] [client 185.193.157.179:39464] [client 185.193.157.179] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "aR9v4p_RkWhJ6CPCcoOp8AAAAJY"]
[Fri Nov 21 03:45:39.320542 2025] [:error] [pid 33419:tid 33476] [client 185.193.157.179:39470] [client 185.193.157.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.193.157.179, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aR9v4zFLqOxO7vC9Cgwh0QAAAFE"]
[Fri Nov 21 10:37:21.988826 2025] [autoindex:error] [pid 46276:tid 46307] [client 213.199.55.196:53570] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Nov 21 14:46:11.664975 2025] [:error] [pid 25431:tid 25503] [client 213.21.239.4:55562] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aSAKs8klhXxmoIExII0BugAAAJA"]
[Fri Nov 21 15:11:15.328688 2025] [:error] [pid 25554:tid 25562] [client 213.21.239.4:52328] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "aSAQkx-NtB-9AzFZrk4ingAAAQQ"]
[Fri Nov 21 15:45:11.866797 2025] [:error] [pid 25430:tid 25483] [client 213.21.239.4:50460] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.svn/wc.db"] [unique_id "aSAYh6pnWJcWt_4foXkxXwAAAFc"]
[Fri Nov 21 16:10:16.482920 2025] [:error] [pid 25521:tid 25525] [client 213.21.239.4:41764] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.svn/wc.db"] [unique_id "aSAeaPhXnBMilDddn3XwMQAAAMI"]
[Sat Nov 22 01:10:53.902023 2025] [:error] [pid 50057:tid 50079] [client 103.186.30.186:50358] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/style.php"] [unique_id "aSCdHVb9j9fTBoI0sRVEnAAAARQ"]
[Sat Nov 22 01:10:54.378166 2025] [:error] [pid 9180:tid 9190] [client 103.186.30.186:63204] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/style.php"] [unique_id "aSCdHrrk9msixUFV2i-L2AAAAEg"]
[Sat Nov 22 01:10:54.971891 2025] [:error] [pid 9180:tid 9193] [client 103.186.30.186:63702] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/style.php"] [unique_id "aSCdHrrk9msixUFV2i-L2gAAAEs"]
[Sat Nov 22 01:10:55.255502 2025] [:error] [pid 9180:tid 9204] [client 103.186.30.186:53760] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/style.php"] [unique_id "aSCdH7rk9msixUFV2i-L3AAAAFY"]
[Sat Nov 22 01:10:55.631719 2025] [:error] [pid 9180:tid 9196] [client 103.186.30.186:58809] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style.php"] [unique_id "aSCdH7rk9msixUFV2i-L3gAAAE4"]
[Sat Nov 22 01:10:55.987831 2025] [:error] [pid 50057:tid 50083] [client 103.186.30.186:50759] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/chosen.php"] [unique_id "aSCdH1b9j9fTBoI0sRVEngAAARg"]
[Sat Nov 22 01:10:56.447817 2025] [:error] [pid 49641:tid 49840] [client 103.186.30.186:59576] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "aSCdIFnhuiDak938N_ay6wAAABE"]
[Sat Nov 22 01:10:56.911517 2025] [:error] [pid 50057:tid 50072] [client 103.186.30.186:51493] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/flower.php"] [unique_id "aSCdIFb9j9fTBoI0sRVEnwAAAQ0"]
[Sat Nov 22 01:10:57.306635 2025] [:error] [pid 9180:tid 9193] [client 103.186.30.186:50548] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/gifclass.php"] [unique_id "aSCdIbrk9msixUFV2i-L5QAAAEs"]
[Sat Nov 22 01:10:57.654954 2025] [:error] [pid 49641:tid 49830] [client 103.186.30.186:52014] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bless.php"] [unique_id "aSCdIVnhuiDak938N_ay7AAAAAc"]
[Sat Nov 22 01:10:57.910958 2025] [:error] [pid 49643:tid 49942] [client 103.186.30.186:49533] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/class-t.api.php"] [unique_id "aSCdIZwUojIRHhF_fj-JFQAAANY"]
[Sat Nov 22 01:10:59.310567 2025] [:error] [pid 49642:tid 49896] [client 103.186.30.186:57768] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/blurbs.php"] [unique_id "aSCdI4OXTPSuQfgUUtWK-QAAAIU"]
[Sat Nov 22 01:10:59.689226 2025] [:error] [pid 49641:tid 49833] [client 103.186.30.186:58055] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/akcc.php"] [unique_id "aSCdI1nhuiDak938N_ay8gAAAAo"]
[Sat Nov 22 01:11:00.212562 2025] [:error] [pid 9180:tid 9192] [client 103.186.30.186:56961] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/abcd.php"] [unique_id "aSCdJLrk9msixUFV2i-L7AAAAEo"]
[Sat Nov 22 01:11:00.552388 2025] [:error] [pid 50057:tid 50078] [client 103.186.30.186:58029] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/shelp.php"] [unique_id "aSCdJFb9j9fTBoI0sRVEowAAARM"]
[Sat Nov 22 01:11:01.249257 2025] [:error] [pid 9180:tid 9199] [client 103.186.30.186:62841] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cord.php"] [unique_id "aSCdJbrk9msixUFV2i-L8AAAAFE"]
[Sat Nov 22 01:11:01.536667 2025] [:error] [pid 50057:tid 50073] [client 103.186.30.186:55828] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/dex.php"] [unique_id "aSCdJVb9j9fTBoI0sRVEpgAAAQ4"]
[Sat Nov 22 01:11:02.240343 2025] [:error] [pid 9180:tid 9197] [client 103.186.30.186:60667] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aSCdJrrk9msixUFV2i-L9wAAAE8"]
[Sat Nov 22 01:11:02.855675 2025] [:error] [pid 49642:tid 49898] [client 103.186.30.186:61584] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/file2.php"] [unique_id "aSCdJoOXTPSuQfgUUtWLAwAAAIc"]
[Sat Nov 22 01:11:03.363401 2025] [:error] [pid 49641:tid 49838] [client 103.186.30.186:59554] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/zwso.php"] [unique_id "aSCdJ1nhuiDak938N_ay-QAAAA8"]
[Sat Nov 22 01:11:03.986240 2025] [:error] [pid 49643:tid 49919] [client 103.186.30.186:63300] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/zwso.php"] [unique_id "aSCdJ5wUojIRHhF_fj-JHgAAAMA"]
[Sat Nov 22 01:11:04.534380 2025] [:error] [pid 9180:tid 9200] [client 103.186.30.186:52760] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "aSCdKLrk9msixUFV2i-MAQAAAFI"]
[Sat Nov 22 01:11:05.167345 2025] [:error] [pid 49642:tid 49892] [client 103.186.30.186:63440] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bolt.php"] [unique_id "aSCdKYOXTPSuQfgUUtWLCwAAAIE"]
[Sat Nov 22 01:11:05.533938 2025] [:error] [pid 49643:tid 49922] [client 103.186.30.186:50782] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/shlo.php"] [unique_id "aSCdKZwUojIRHhF_fj-JIQAAAMM"]
[Sat Nov 22 01:11:06.214328 2025] [:error] [pid 9180:tid 9199] [client 103.186.30.186:50508] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/133.php"] [unique_id "aSCdKrrk9msixUFV2i-MBgAAAFE"]
[Sat Nov 22 01:11:06.492715 2025] [:error] [pid 50057:tid 50079] [client 103.186.30.186:59554] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ahax.php"] [unique_id "aSCdKlb9j9fTBoI0sRVEsAAAARQ"]
[Sat Nov 22 01:11:07.102160 2025] [:error] [pid 49642:tid 49896] [client 103.186.30.186:58196] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/php8.php"] [unique_id "aSCdK4OXTPSuQfgUUtWLFgAAAIU"]
[Sat Nov 22 01:11:07.436822 2025] [:error] [pid 9180:tid 9190] [client 103.186.30.186:53870] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/lufix1.php"] [unique_id "aSCdK7rk9msixUFV2i-MDgAAAEg"]
[Sat Nov 22 01:11:08.179279 2025] [:error] [pid 9180:tid 9187] [client 103.186.30.186:52280] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/witmm.php"] [unique_id "aSCdLLrk9msixUFV2i-MFAAAAEU"]
[Sat Nov 22 01:11:08.504120 2025] [:error] [pid 9180:tid 9197] [client 103.186.30.186:63438] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "aSCdLLrk9msixUFV2i-MGQAAAE8"]
[Sat Nov 22 01:11:09.264320 2025] [:error] [pid 49643:tid 49931] [client 103.186.30.186:55131] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aSCdLZwUojIRHhF_fj-JJgAAAMs"]
[Sat Nov 22 01:11:09.980831 2025] [:error] [pid 49642:tid 49899] [client 103.186.30.186:51618] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/index.php"] [unique_id "aSCdLYOXTPSuQfgUUtWLIAAAAIg"]
[Sat Nov 22 01:11:10.224084 2025] [:error] [pid 49641:tid 49823] [client 103.186.30.186:55216] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "aSCdLlnhuiDak938N_azEgAAAAA"]
[Sat Nov 22 01:11:10.509516 2025] [:error] [pid 50057:tid 50076] [client 103.186.30.186:54631] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/222.php"] [unique_id "aSCdLlb9j9fTBoI0sRVEuQAAARE"]
[Sat Nov 22 01:11:10.956518 2025] [:error] [pid 49641:tid 49824] [client 103.186.30.186:64066] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/files.php"] [unique_id "aSCdLlnhuiDak938N_azGwAAAAE"]
[Sat Nov 22 01:11:11.223109 2025] [:error] [pid 50057:tid 50069] [client 103.186.30.186:54806] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-editor.php"] [unique_id "aSCdL1b9j9fTBoI0sRVEvgAAAQo"]
[Sat Nov 22 03:53:08.404363 2025] [:error] [pid 53479:tid 53551] [client 103.167.150.158:54779] [client 103.167.150.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/media/system/js/core.js"] [unique_id "aSDDJG6cicFF3Aas-oQ8DQAAAI8"]
[Sat Nov 22 07:22:30.115883 2025] [:error] [pid 53479:tid 53536] [client 20.122.78.118:1667] [client 20.122.78.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.122.78.118, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aSD0Nm6cicFF3Aas-oSoZgAAAIA"], referer: https://www.google.fr/
[Sat Nov 22 07:22:48.143657 2025] [:error] [pid 25856:tid 25881] [client 20.122.78.118:7326] [client 20.122.78.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "aSD0SBsTP0wy94zKUvHwtwAAARc"], referer: https://www.google.co.uk/
[Sat Nov 22 07:23:27.055595 2025] [:error] [pid 53478:tid 53533] [client 20.122.78.118:2204] [client 20.122.78.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSD0bwhUYdXBbQswAdRHjwAAAFg"], referer: https://www.google.com/
[Sat Nov 22 07:23:41.132535 2025] [autoindex:error] [pid 53477:tid 53485] [client 20.122.78.118:5913] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sat Nov 22 07:23:50.437881 2025] [autoindex:error] [pid 25856:tid 25870] [client 20.122.78.118:4866] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sat Nov 22 07:23:50.647889 2025] [autoindex:error] [pid 25856:tid 25862] [client 20.122.78.118:4866] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sat Nov 22 07:24:16.670143 2025] [autoindex:error] [pid 53477:tid 53482] [client 20.122.78.118:7039] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sat Nov 22 07:24:16.885919 2025] [autoindex:error] [pid 53477:tid 53499] [client 20.122.78.118:7039] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sat Nov 22 07:24:17.136357 2025] [autoindex:error] [pid 53477:tid 53487] [client 20.122.78.118:7039] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Sat Nov 22 07:24:17.346825 2025] [:error] [pid 53477:tid 53504] [client 20.122.78.118:7039] [client 20.122.78.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSD0oX7Lu30Ku9O40aINqQAAABc"], referer: https://www.yahoo.com/
[Sat Nov 22 07:24:18.079789 2025] [autoindex:error] [pid 53478:tid 53524] [client 20.122.78.118:5487] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sat Nov 22 07:24:18.292687 2025] [autoindex:error] [pid 53478:tid 53521] [client 20.122.78.118:5487] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sat Nov 22 07:24:18.683616 2025] [autoindex:error] [pid 53478:tid 53533] [client 20.122.78.118:5487] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sat Nov 22 07:24:49.616161 2025] [:error] [pid 53566:tid 53570] [client 20.122.78.118:3365] [client 20.122.78.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.122.78.118, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aSD0wcbSHDBkRbwMbd5v4QAAAMI"], referer: https://duckduckgo.com/
[Sat Nov 22 16:10:50.984248 2025] [proxy_fcgi:error] [pid 9547:tid 9573] [client 98.71.99.66:20369] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 16:10:52.698703 2025] [:error] [pid 53477:tid 53495] [client 98.71.99.66:20416] [client 98.71.99.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/0.php"] [unique_id "aSFwDH7Lu30Ku9O40aKPwgAAAA4"]
[Sat Nov 22 16:10:56.039496 2025] [:error] [pid 53478:tid 53518] [client 98.71.99.66:20385] [client 98.71.99.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/cs.php"] [unique_id "aSFwEAhUYdXBbQswAdTOyQAAAEk"]
[Sat Nov 22 16:10:57.729735 2025] [:error] [pid 9547:tid 9562] [client 98.71.99.66:20475] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wikindex.php"] [unique_id "aSFwEdClOR5qk7DoMeF9HwAAAUk"]
[Sat Nov 22 16:10:59.874649 2025] [:error] [pid 53566:tid 53574] [client 98.71.99.66:20445] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wikindex.php"] [unique_id "aSFwE8bSHDBkRbwMbd4ELAAAAMY"]
[Sat Nov 22 16:11:00.653754 2025] [:error] [pid 25856:tid 25878] [client 98.71.99.66:20471] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wikindex.php"] [unique_id "aSFwFBsTP0wy94zKUvGNbAAAARQ"]
[Sat Nov 22 16:11:01.290368 2025] [:error] [pid 9547:tid 9577] [client 98.71.99.66:20430] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wikindex.php"] [unique_id "aSFwFdClOR5qk7DoMeF9JgAAAVg"]
[Sat Nov 22 16:11:02.270917 2025] [:error] [pid 53477:tid 53486] [client 98.71.99.66:20362] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/images/m.php"] [unique_id "aSFwFn7Lu30Ku9O40aKPzQAAAAU"]
[Sat Nov 22 16:11:03.168958 2025] [:error] [pid 9547:tid 9570] [client 98.71.99.66:20441] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/images/m.php"] [unique_id "aSFwF9ClOR5qk7DoMeF9KQAAAVE"]
[Sat Nov 22 16:11:04.447727 2025] [:error] [pid 9547:tid 9564] [client 98.71.99.66:20425] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/images/m.php"] [unique_id "aSFwGNClOR5qk7DoMeF9LAAAAUs"]
[Sat Nov 22 16:11:05.760226 2025] [:error] [pid 9547:tid 9562] [client 98.71.99.66:20371] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/images/m.php"] [unique_id "aSFwGdClOR5qk7DoMeF9MAAAAUk"]
[Sat Nov 22 16:11:06.812824 2025] [:error] [pid 53479:tid 53537] [client 98.71.99.66:20363] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sko.php"] [unique_id "aSFwGm6cicFF3Aas-oRZ2QAAAIE"]
[Sat Nov 22 16:11:07.699774 2025] [:error] [pid 53478:tid 53512] [client 98.71.99.66:20419] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sko.php"] [unique_id "aSFwGwhUYdXBbQswAdTO1AAAAEM"]
[Sat Nov 22 16:11:08.646246 2025] [:error] [pid 53477:tid 53495] [client 98.71.99.66:20420] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sko.php"] [unique_id "aSFwHH7Lu30Ku9O40aKPzwAAAA4"]
[Sat Nov 22 16:11:09.453528 2025] [:error] [pid 25856:tid 25864] [client 98.71.99.66:20396] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sko.php"] [unique_id "aSFwHRsTP0wy94zKUvGNcwAAAQY"]
[Sat Nov 22 16:11:10.043247 2025] [:error] [pid 25856:tid 25875] [client 98.71.99.66:20352] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/tx1.php"] [unique_id "aSFwHhsTP0wy94zKUvGNdQAAARE"]
[Sat Nov 22 16:11:10.774892 2025] [:error] [pid 25856:tid 25880] [client 98.71.99.66:20355] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/tx1.php"] [unique_id "aSFwHhsTP0wy94zKUvGNdwAAARY"]
[Sat Nov 22 16:11:11.553795 2025] [:error] [pid 53477:tid 53498] [client 98.71.99.66:20456] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/tx1.php"] [unique_id "aSFwH37Lu30Ku9O40aKP0wAAABE"]
[Sat Nov 22 16:11:12.298726 2025] [:error] [pid 53477:tid 53483] [client 98.71.99.66:20459] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/tx1.php"] [unique_id "aSFwIH7Lu30Ku9O40aKP1QAAAAI"]
[Sat Nov 22 16:11:13.075169 2025] [:error] [pid 9547:tid 9554] [client 98.71.99.66:20447] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xv.php"] [unique_id "aSFwIdClOR5qk7DoMeF9NQAAAUE"]
[Sat Nov 22 16:11:14.794079 2025] [:error] [pid 53477:tid 53484] [client 98.71.99.66:20450] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xv.php"] [unique_id "aSFwIn7Lu30Ku9O40aKP2AAAAAM"]
[Sat Nov 22 16:11:15.891357 2025] [:error] [pid 53477:tid 53499] [client 98.71.99.66:20386] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xv.php"] [unique_id "aSFwI37Lu30Ku9O40aKP3QAAABI"]
[Sat Nov 22 16:11:17.355430 2025] [:error] [pid 53477:tid 53495] [client 98.71.99.66:20377] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xv.php"] [unique_id "aSFwJX7Lu30Ku9O40aKP4wAAAA4"]
[Sat Nov 22 16:11:18.152627 2025] [:error] [pid 53479:tid 53541] [client 98.71.99.66:20296] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/x56.php"] [unique_id "aSFwJm6cicFF3Aas-oRZ3gAAAIU"]
[Sat Nov 22 16:11:19.115398 2025] [:error] [pid 53479:tid 53542] [client 98.71.99.66:20426] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/x56.php"] [unique_id "aSFwJ26cicFF3Aas-oRZ3wAAAIY"]
[Sat Nov 22 16:11:19.873037 2025] [:error] [pid 53479:tid 53543] [client 98.71.99.66:20466] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/x56.php"] [unique_id "aSFwJ26cicFF3Aas-oRZ4gAAAIc"]
[Sat Nov 22 16:11:20.716043 2025] [:error] [pid 53479:tid 53557] [client 98.71.99.66:20451] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/x56.php"] [unique_id "aSFwKG6cicFF3Aas-oRZ5AAAAJU"]
[Sat Nov 22 16:11:21.710312 2025] [:error] [pid 53479:tid 53547] [client 98.71.99.66:20366] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/htaccess.php"] [unique_id "aSFwKW6cicFF3Aas-oRZ5wAAAIs"]
[Sat Nov 22 16:11:22.284900 2025] [:error] [pid 53479:tid 53546] [client 98.71.99.66:20421] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/htaccess.php"] [unique_id "aSFwKm6cicFF3Aas-oRZ7AAAAIo"]
[Sat Nov 22 16:11:23.336684 2025] [:error] [pid 53479:tid 53538] [client 98.71.99.66:20368] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/htaccess.php"] [unique_id "aSFwK26cicFF3Aas-oRZ7wAAAII"]
[Sat Nov 22 16:11:24.169050 2025] [:error] [pid 25856:tid 25858] [client 98.71.99.66:20361] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/htaccess.php"] [unique_id "aSFwLBsTP0wy94zKUvGNfQAAAQA"]
[Sat Nov 22 16:11:25.098537 2025] [:error] [pid 9547:tid 9559] [client 98.71.99.66:20422] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/readme.php"] [unique_id "aSFwLdClOR5qk7DoMeF9NwAAAUY"]
[Sat Nov 22 16:11:25.927430 2025] [:error] [pid 53479:tid 53557] [client 98.71.99.66:20422] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/readme.php"] [unique_id "aSFwLW6cicFF3Aas-oRZ9QAAAJU"]
[Sat Nov 22 16:11:27.416372 2025] [:error] [pid 53479:tid 53540] [client 98.71.99.66:20297] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/readme.php"] [unique_id "aSFwL26cicFF3Aas-oRZ9gAAAIQ"]
[Sat Nov 22 16:11:28.080743 2025] [:error] [pid 53479:tid 53546] [client 98.71.99.66:20442] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/readme.php"] [unique_id "aSFwMG6cicFF3Aas-oRZ-QAAAIo"]
[Sat Nov 22 16:11:28.947161 2025] [:error] [pid 53566:tid 53574] [client 98.71.99.66:20398] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/Cok.php"] [unique_id "aSFwMMbSHDBkRbwMbd4EPgAAAMY"]
[Sat Nov 22 16:11:29.627588 2025] [:error] [pid 25856:tid 25873] [client 98.71.99.66:20435] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/Cok.php"] [unique_id "aSFwMRsTP0wy94zKUvGNgAAAAQ8"]
[Sat Nov 22 16:11:31.066420 2025] [:error] [pid 53477:tid 53491] [client 98.71.99.66:20432] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/Cok.php"] [unique_id "aSFwM37Lu30Ku9O40aKP_QAAAAo"]
[Sat Nov 22 16:11:31.811946 2025] [:error] [pid 53566:tid 53572] [client 98.71.99.66:20357] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/Cok.php"] [unique_id "aSFwM8bSHDBkRbwMbd4ERgAAAMQ"]
[Sat Nov 22 16:11:32.590812 2025] [:error] [pid 53477:tid 53500] [client 98.71.99.66:20359] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/hob.php"] [unique_id "aSFwNH7Lu30Ku9O40aKP_gAAABM"]
[Sat Nov 22 16:11:33.256029 2025] [:error] [pid 53479:tid 53556] [client 98.71.99.66:20476] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/hob.php"] [unique_id "aSFwNW6cicFF3Aas-oRaAAAAAJQ"]
[Sat Nov 22 16:11:34.186382 2025] [:error] [pid 53566:tid 53581] [client 98.71.99.66:20433] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/hob.php"] [unique_id "aSFwNsbSHDBkRbwMbd4ESwAAAM0"]
[Sat Nov 22 16:11:35.087360 2025] [:error] [pid 53479:tid 53560] [client 98.71.99.66:20455] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/hob.php"] [unique_id "aSFwN26cicFF3Aas-oRaAwAAAJg"]
[Sat Nov 22 16:11:36.320011 2025] [:error] [pid 25856:tid 25880] [client 98.71.99.66:20374] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/x50.php"] [unique_id "aSFwOBsTP0wy94zKUvGNgwAAARY"]
[Sat Nov 22 16:11:37.773518 2025] [:error] [pid 25856:tid 25877] [client 98.71.99.66:20410] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/x50.php"] [unique_id "aSFwORsTP0wy94zKUvGNhwAAARM"]
[Sat Nov 22 16:11:39.229664 2025] [:error] [pid 53478:tid 53525] [client 98.71.99.66:20465] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/x50.php"] [unique_id "aSFwOwhUYdXBbQswAdTO3AAAAFA"]
[Sat Nov 22 16:11:39.976772 2025] [:error] [pid 53478:tid 53521] [client 98.71.99.66:20436] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/x50.php"] [unique_id "aSFwOwhUYdXBbQswAdTO3QAAAEw"]
[Sat Nov 22 16:11:40.842833 2025] [:error] [pid 25856:tid 25866] [client 98.71.99.66:20424] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fh26.php"] [unique_id "aSFwPBsTP0wy94zKUvGNiQAAAQg"]
[Sat Nov 22 16:11:41.653525 2025] [:error] [pid 9547:tid 9562] [client 98.71.99.66:20460] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fh26.php"] [unique_id "aSFwPdClOR5qk7DoMeF9RQAAAUk"]
[Sat Nov 22 16:11:42.478622 2025] [:error] [pid 53477:tid 53489] [client 98.71.99.66:20403] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fh26.php"] [unique_id "aSFwPn7Lu30Ku9O40aKQBAAAAAg"]
[Sat Nov 22 16:11:43.158492 2025] [:error] [pid 25856:tid 25858] [client 98.71.99.66:20478] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fh26.php"] [unique_id "aSFwPxsTP0wy94zKUvGNjAAAAQA"]
[Sat Nov 22 16:11:43.765326 2025] [:error] [pid 25856:tid 25879] [client 98.71.99.66:20479] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-wlx.php"] [unique_id "aSFwPxsTP0wy94zKUvGNjwAAARU"]
[Sat Nov 22 16:11:44.362965 2025] [:error] [pid 9547:tid 9568] [client 98.71.99.66:20434] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-wlx.php"] [unique_id "aSFwQNClOR5qk7DoMeF9SQAAAU8"]
[Sat Nov 22 16:11:45.768088 2025] [:error] [pid 53477:tid 53482] [client 98.71.99.66:20388] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-wlx.php"] [unique_id "aSFwQX7Lu30Ku9O40aKQBQAAAAE"]
[Sat Nov 22 16:11:46.494636 2025] [:error] [pid 9547:tid 9565] [client 98.71.99.66:20468] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-wlx.php"] [unique_id "aSFwQtClOR5qk7DoMeF9SwAAAUw"]
[Sat Nov 22 16:11:47.165973 2025] [:error] [pid 53478:tid 53528] [client 98.71.99.66:20303] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/kal.php"] [unique_id "aSFwQwhUYdXBbQswAdTO4wAAAFM"]
[Sat Nov 22 16:11:48.497033 2025] [:error] [pid 53566:tid 53571] [client 98.71.99.66:20288] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/kal.php"] [unique_id "aSFwRMbSHDBkRbwMbd4EYAAAAMM"]
[Sat Nov 22 16:11:49.969891 2025] [:error] [pid 25856:tid 25866] [client 98.71.99.66:20429] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/kal.php"] [unique_id "aSFwRRsTP0wy94zKUvGNmAAAAQg"]
[Sat Nov 22 16:11:51.049806 2025] [:error] [pid 9547:tid 9556] [client 98.71.99.66:20437] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/kal.php"] [unique_id "aSFwR9ClOR5qk7DoMeF9TgAAAUM"]
[Sat Nov 22 16:11:52.115532 2025] [:error] [pid 53479:tid 53546] [client 98.71.99.66:20329] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fv.php"] [unique_id "aSFwSG6cicFF3Aas-oRaGAAAAIo"]
[Sat Nov 22 16:11:54.027016 2025] [:error] [pid 53477:tid 53494] [client 98.71.99.66:20446] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fv.php"] [unique_id "aSFwSn7Lu30Ku9O40aKQEAAAAA0"]
[Sat Nov 22 16:11:55.375447 2025] [:error] [pid 53477:tid 53483] [client 98.71.99.66:20393] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fv.php"] [unique_id "aSFwS37Lu30Ku9O40aKQFgAAAAI"]
[Sat Nov 22 16:12:26.250640 2025] [:error] [pid 25856:tid 25863] [client 98.71.99.66:20415] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/yellow.php"] [unique_id "aSFwahsTP0wy94zKUvGNwgAAAQU"]
[Sat Nov 22 16:12:27.344159 2025] [:error] [pid 25856:tid 25879] [client 98.71.99.66:20335] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/yellow.php"] [unique_id "aSFwaxsTP0wy94zKUvGNxQAAARU"]
[Sat Nov 22 16:12:28.525783 2025] [:error] [pid 53479:tid 53554] [client 98.71.99.66:20390] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/yellow.php"] [unique_id "aSFwbG6cicFF3Aas-oRabQAAAJI"]
[Sat Nov 22 16:12:29.187180 2025] [:error] [pid 9547:tid 9567] [client 98.71.99.66:20382] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/yellow.php"] [unique_id "aSFwbdClOR5qk7DoMeF9hwAAAU4"]
[Sat Nov 22 16:12:30.026946 2025] [:error] [pid 53478:tid 53524] [client 98.71.99.66:20370] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/cong.php"] [unique_id "aSFwbghUYdXBbQswAdTPGgAAAE8"]
[Sat Nov 22 16:12:31.163946 2025] [:error] [pid 25856:tid 25877] [client 98.71.99.66:20407] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/cong.php"] [unique_id "aSFwbxsTP0wy94zKUvGNygAAARM"]
[Sat Nov 22 16:12:32.265280 2025] [:error] [pid 25856:tid 25872] [client 98.71.99.66:20395] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/cong.php"] [unique_id "aSFwcBsTP0wy94zKUvGNzAAAAQ4"]
[Sat Nov 22 16:12:33.123117 2025] [:error] [pid 9547:tid 9566] [client 98.71.99.66:20408] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/cong.php"] [unique_id "aSFwcdClOR5qk7DoMeF9jwAAAU0"]
[Sat Nov 22 16:12:34.038309 2025] [:error] [pid 53478:tid 53533] [client 98.71.99.66:20409] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fw.php"] [unique_id "aSFwcghUYdXBbQswAdTPJQAAAFg"]
[Sat Nov 22 16:12:34.708441 2025] [:error] [pid 25856:tid 25859] [client 98.71.99.66:20330] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fw.php"] [unique_id "aSFwchsTP0wy94zKUvGN0QAAAQE"]
[Sat Nov 22 16:12:35.473925 2025] [:error] [pid 9547:tid 9555] [client 98.71.99.66:20341] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fw.php"] [unique_id "aSFwc9ClOR5qk7DoMeF9kQAAAUI"]
[Sat Nov 22 16:12:36.455733 2025] [:error] [pid 9547:tid 9576] [client 98.71.99.66:20412] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fw.php"] [unique_id "aSFwdNClOR5qk7DoMeF9lAAAAVc"]
[Sat Nov 22 16:12:37.376331 2025] [:error] [pid 53478:tid 53532] [client 98.71.99.66:20453] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bs1.php"] [unique_id "aSFwdQhUYdXBbQswAdTPKQAAAFc"]
[Sat Nov 22 16:12:38.183210 2025] [:error] [pid 53477:tid 53484] [client 98.71.99.66:20292] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bs1.php"] [unique_id "aSFwdn7Lu30Ku9O40aKQRAAAAAM"]
[Sat Nov 22 16:12:39.021226 2025] [:error] [pid 53479:tid 53553] [client 98.71.99.66:20376] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bs1.php"] [unique_id "aSFwd26cicFF3Aas-oRacQAAAJE"]
[Sat Nov 22 16:12:40.042886 2025] [:error] [pid 53479:tid 53549] [client 98.71.99.66:20364] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bs1.php"] [unique_id "aSFweG6cicFF3Aas-oRacwAAAI0"]
[Sat Nov 22 16:12:41.645250 2025] [:error] [pid 53478:tid 53514] [client 98.71.99.66:20477] [client 98.71.99.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSFweQhUYdXBbQswAdTPNQAAAEU"]
[Sat Nov 22 16:12:43.172167 2025] [:error] [pid 9547:tid 9572] [client 98.71.99.66:20313] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/termps.php"] [unique_id "aSFwe9ClOR5qk7DoMeF9mgAAAVM"]
[Sat Nov 22 16:12:44.003378 2025] [:error] [pid 53478:tid 53510] [client 98.71.99.66:20322] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/termps.php"] [unique_id "aSFwfAhUYdXBbQswAdTPOgAAAEE"]
[Sat Nov 22 16:12:45.297432 2025] [:error] [pid 53477:tid 53494] [client 98.71.99.66:20271] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/termps.php"] [unique_id "aSFwfX7Lu30Ku9O40aKQUgAAAA0"]
[Sat Nov 22 16:12:46.001034 2025] [:error] [pid 53477:tid 53483] [client 98.71.99.66:20399] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/termps.php"] [unique_id "aSFwfX7Lu30Ku9O40aKQVQAAAAI"]
[Sat Nov 22 16:12:46.779586 2025] [:error] [pid 53478:tid 53520] [client 98.71.99.66:20360] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/co.php"] [unique_id "aSFwfghUYdXBbQswAdTPQwAAAEs"]
[Sat Nov 22 16:12:47.733860 2025] [:error] [pid 9547:tid 9574] [client 98.71.99.66:20381] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/co.php"] [unique_id "aSFwf9ClOR5qk7DoMeF9nQAAAVU"]
[Sat Nov 22 16:12:48.572361 2025] [:error] [pid 53479:tid 53543] [client 98.71.99.66:20375] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/co.php"] [unique_id "aSFwgG6cicFF3Aas-oRaeAAAAIc"]
[Sat Nov 22 16:12:49.373450 2025] [:error] [pid 53478:tid 53526] [client 98.71.99.66:20291] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/co.php"] [unique_id "aSFwgQhUYdXBbQswAdTPSgAAAFE"]
[Sat Nov 22 16:12:50.186115 2025] [:error] [pid 25856:tid 25872] [client 98.71.99.66:20251] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/cong.php"] [unique_id "aSFwghsTP0wy94zKUvGN3QAAAQ4"]
[Sat Nov 22 16:12:50.951166 2025] [:error] [pid 53479:tid 53557] [client 98.71.99.66:20470] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/cong.php"] [unique_id "aSFwgm6cicFF3Aas-oRaegAAAJU"]
[Sat Nov 22 16:12:52.135151 2025] [:error] [pid 53477:tid 53494] [client 98.71.99.66:20439] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/cong.php"] [unique_id "aSFwhH7Lu30Ku9O40aKQYQAAAA0"]
[Sat Nov 22 16:12:52.852378 2025] [:error] [pid 53479:tid 53546] [client 98.71.99.66:20308] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/cong.php"] [unique_id "aSFwhG6cicFF3Aas-oRafwAAAIo"]
[Sat Nov 22 16:12:54.357919 2025] [:error] [pid 25856:tid 25871] [client 98.71.99.66:20333] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/atomlib.php"] [unique_id "aSFwhhsTP0wy94zKUvGN5QAAAQ0"]
[Sat Nov 22 16:12:55.632722 2025] [:error] [pid 53477:tid 53485] [client 98.71.99.66:20318] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/atomlib.php"] [unique_id "aSFwh37Lu30Ku9O40aKQZgAAAAQ"]
[Sat Nov 22 16:12:56.697876 2025] [:error] [pid 53477:tid 53487] [client 98.71.99.66:20224] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/atomlib.php"] [unique_id "aSFwiH7Lu30Ku9O40aKQaQAAAAY"]
[Sat Nov 22 16:12:57.522071 2025] [:error] [pid 53478:tid 53521] [client 98.71.99.66:20378] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/atomlib.php"] [unique_id "aSFwiQhUYdXBbQswAdTPVgAAAEw"]
[Sat Nov 22 16:12:58.145850 2025] [:error] [pid 53479:tid 53547] [client 98.71.99.66:20379] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/w.php"] [unique_id "aSFwim6cicFF3Aas-oRahgAAAIs"]
[Sat Nov 22 16:12:59.166862 2025] [:error] [pid 53566:tid 53591] [client 98.71.99.66:20469] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/w.php"] [unique_id "aSFwi8bSHDBkRbwMbd4EpAAAANc"]
[Sat Nov 22 16:13:00.130335 2025] [:error] [pid 53479:tid 53556] [client 98.71.99.66:20311] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/w.php"] [unique_id "aSFwjG6cicFF3Aas-oRaiQAAAJQ"]
[Sat Nov 22 16:13:01.223305 2025] [:error] [pid 25856:tid 25877] [client 98.71.99.66:20397] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/w.php"] [unique_id "aSFwjRsTP0wy94zKUvGN6QAAARM"]
[Sat Nov 22 16:13:02.171236 2025] [:error] [pid 53479:tid 53546] [client 98.71.99.66:20431] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/404.php"] [unique_id "aSFwjm6cicFF3Aas-oRajQAAAIo"]
[Sat Nov 22 16:13:03.633110 2025] [:error] [pid 53478:tid 53510] [client 98.71.99.66:20347] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/404.php"] [unique_id "aSFwjwhUYdXBbQswAdTPXwAAAEE"]
[Sat Nov 22 16:13:05.219200 2025] [:error] [pid 53477:tid 53505] [client 98.71.99.66:20401] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/404.php"] [unique_id "aSFwkX7Lu30Ku9O40aKQcAAAABg"]
[Sat Nov 22 16:13:06.171678 2025] [:error] [pid 9547:tid 9556] [client 98.71.99.66:20440] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/404.php"] [unique_id "aSFwktClOR5qk7DoMeF9rAAAAUM"]
[Sat Nov 22 16:13:07.035747 2025] [:error] [pid 53479:tid 53540] [client 98.71.99.66:20404] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "aSFwk26cicFF3Aas-oRamQAAAIQ"]
[Sat Nov 22 16:13:07.833922 2025] [:error] [pid 53478:tid 53517] [client 98.71.99.66:20392] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "aSFwkwhUYdXBbQswAdTPZgAAAEg"]
[Sat Nov 22 16:13:08.796595 2025] [:error] [pid 53478:tid 53509] [client 98.71.99.66:20406] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "aSFwlAhUYdXBbQswAdTPaAAAAEA"]
[Sat Nov 22 16:13:09.745397 2025] [:error] [pid 53477:tid 53499] [client 98.71.99.66:20294] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "aSFwlX7Lu30Ku9O40aKQdgAAABI"]
[Sat Nov 22 16:13:10.538453 2025] [:error] [pid 25856:tid 25870] [client 98.71.99.66:20314] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/product.php"] [unique_id "aSFwlhsTP0wy94zKUvGN9QAAAQw"]
[Sat Nov 22 16:13:11.350103 2025] [:error] [pid 53478:tid 53529] [client 98.71.99.66:20328] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/product.php"] [unique_id "aSFwlwhUYdXBbQswAdTPcgAAAFQ"]
[Sat Nov 22 16:13:12.027567 2025] [:error] [pid 53478:tid 53519] [client 98.71.99.66:20462] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/product.php"] [unique_id "aSFwmAhUYdXBbQswAdTPdQAAAEo"]
[Sat Nov 22 16:13:13.254200 2025] [:error] [pid 9547:tid 9562] [client 98.71.99.66:20310] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/product.php"] [unique_id "aSFwmdClOR5qk7DoMeF9tAAAAUk"]
[Sat Nov 22 16:13:14.556166 2025] [:error] [pid 53479:tid 53548] [client 98.71.99.66:20340] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/function.php"] [unique_id "aSFwmm6cicFF3Aas-oRaqQAAAIw"]
[Sat Nov 22 16:13:15.739462 2025] [:error] [pid 53479:tid 53550] [client 98.71.99.66:20349] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/function.php"] [unique_id "aSFwm26cicFF3Aas-oRasQAAAI4"]
[Sat Nov 22 16:13:16.462220 2025] [:error] [pid 53477:tid 53481] [client 98.71.99.66:20339] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/function.php"] [unique_id "aSFwnH7Lu30Ku9O40aKQfQAAAAA"]
[Sat Nov 22 16:13:17.383609 2025] [:error] [pid 9547:tid 9557] [client 98.71.99.66:20339] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/function.php"] [unique_id "aSFwndClOR5qk7DoMeF9uAAAAUQ"]
[Sat Nov 22 16:13:18.130449 2025] [:error] [pid 53566:tid 53576] [client 98.71.99.66:20278] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/0x.php"] [unique_id "aSFwnsbSHDBkRbwMbd4EvwAAAMg"]
[Sat Nov 22 16:13:18.835729 2025] [:error] [pid 53477:tid 53500] [client 98.71.99.66:20413] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/0x.php"] [unique_id "aSFwnn7Lu30Ku9O40aKQfgAAABM"]
[Sat Nov 22 16:13:19.670617 2025] [:error] [pid 53566:tid 53586] [client 98.71.99.66:20444] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/0x.php"] [unique_id "aSFwn8bSHDBkRbwMbd4EwgAAANI"]
[Sat Nov 22 16:13:20.305324 2025] [:error] [pid 53566:tid 53587] [client 98.71.99.66:20265] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/0x.php"] [unique_id "aSFwoMbSHDBkRbwMbd4ExQAAANM"]
[Sat Nov 22 16:13:21.113326 2025] [:error] [pid 9547:tid 9559] [client 98.71.99.66:20343] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/css.php"] [unique_id "aSFwodClOR5qk7DoMeF9uwAAAUY"]
[Sat Nov 22 16:13:21.863033 2025] [:error] [pid 53477:tid 53496] [client 98.71.99.66:20321] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/css.php"] [unique_id "aSFwoX7Lu30Ku9O40aKQgAAAAA8"]
[Sat Nov 22 16:13:22.911924 2025] [:error] [pid 53479:tid 53556] [client 98.71.99.66:20231] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/css.php"] [unique_id "aSFwom6cicFF3Aas-oRavgAAAJQ"]
[Sat Nov 22 16:13:23.844988 2025] [:error] [pid 53479:tid 53558] [client 98.71.99.66:20299] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/css.php"] [unique_id "aSFwo26cicFF3Aas-oRawAAAAJY"]
[Sat Nov 22 16:13:38.146895 2025] [:error] [pid 53479:tid 53556] [client 98.71.99.66:20344] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/about.php"] [unique_id "aSFwsm6cicFF3Aas-oRayQAAAJQ"]
[Sat Nov 22 16:13:39.209180 2025] [:error] [pid 53479:tid 53560] [client 98.71.99.66:20351] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/about.php"] [unique_id "aSFws26cicFF3Aas-oRaygAAAJg"]
[Sat Nov 22 16:13:40.430842 2025] [:error] [pid 25856:tid 25875] [client 98.71.99.66:20257] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/about.php"] [unique_id "aSFwtBsTP0wy94zKUvGOJAAAARE"]
[Sat Nov 22 16:13:41.114837 2025] [:error] [pid 53478:tid 53517] [client 98.71.99.66:20402] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/about.php"] [unique_id "aSFwtQhUYdXBbQswAdTPsAAAAEg"]
[Sat Nov 22 16:13:42.040792 2025] [:error] [pid 9547:tid 9557] [client 98.71.99.66:20348] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/alfa.php"] [unique_id "aSFwttClOR5qk7DoMeF9xwAAAUQ"]
[Sat Nov 22 16:13:42.747316 2025] [:error] [pid 25856:tid 25881] [client 98.71.99.66:20290] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/alfa.php"] [unique_id "aSFwthsTP0wy94zKUvGOJwAAARc"]
[Sat Nov 22 16:13:43.473000 2025] [:error] [pid 53479:tid 53549] [client 98.71.99.66:20244] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/alfa.php"] [unique_id "aSFwt26cicFF3Aas-oRa0QAAAI0"]
[Sat Nov 22 16:13:44.075671 2025] [:error] [pid 53479:tid 53539] [client 98.71.99.66:20293] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/alfa.php"] [unique_id "aSFwuG6cicFF3Aas-oRa1QAAAIM"]
[Sat Nov 22 16:13:44.932492 2025] [:error] [pid 53479:tid 53556] [client 98.71.99.66:20305] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/buy.php"] [unique_id "aSFwuG6cicFF3Aas-oRa4AAAAJQ"]
[Sat Nov 22 16:13:46.034962 2025] [:error] [pid 53477:tid 53497] [client 98.71.99.66:20284] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/buy.php"] [unique_id "aSFwun7Lu30Ku9O40aKQmwAAABA"]
[Sat Nov 22 16:13:46.997567 2025] [:error] [pid 9547:tid 9562] [client 98.71.99.66:20307] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/buy.php"] [unique_id "aSFwutClOR5qk7DoMeF92AAAAUk"]
[Sat Nov 22 16:13:47.858253 2025] [:error] [pid 53479:tid 53556] [client 98.71.99.66:20245] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/buy.php"] [unique_id "aSFwu26cicFF3Aas-oRa9AAAAJQ"]
[Sat Nov 22 16:13:48.696897 2025] [:error] [pid 53479:tid 53557] [client 98.71.99.66:20258] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSFwvG6cicFF3Aas-oRa-AAAAJU"]
[Sat Nov 22 16:13:50.106583 2025] [:error] [pid 53477:tid 53487] [client 98.71.99.66:20247] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSFwvn7Lu30Ku9O40aKQnAAAAAY"]
[Sat Nov 22 16:13:51.038460 2025] [:error] [pid 53479:tid 53551] [client 98.71.99.66:20304] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSFwv26cicFF3Aas-oRa_gAAAI8"]
[Sat Nov 22 16:13:52.178568 2025] [:error] [pid 9547:tid 9557] [client 98.71.99.66:20317] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSFwwNClOR5qk7DoMeF92wAAAUQ"]
[Sat Nov 22 16:13:52.896973 2025] [:error] [pid 53478:tid 53511] [client 98.71.99.66:20252] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSFwwAhUYdXBbQswAdTPvgAAAEI"]
[Sat Nov 22 16:13:53.841895 2025] [:error] [pid 9547:tid 9565] [client 98.71.99.66:20179] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSFwwdClOR5qk7DoMeF93AAAAUw"]
[Sat Nov 22 16:13:54.798077 2025] [:error] [pid 53566:tid 53588] [client 98.71.99.66:20417] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSFwwsbSHDBkRbwMbd4E8AAAANQ"]
[Sat Nov 22 16:13:55.690872 2025] [:error] [pid 9547:tid 9561] [client 98.71.99.66:20173] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSFww9ClOR5qk7DoMeF93wAAAUg"]
[Sat Nov 22 16:13:56.473052 2025] [:error] [pid 53479:tid 53559] [client 98.71.99.66:20354] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSFwxG6cicFF3Aas-oRbCAAAAJc"]
[Sat Nov 22 16:13:57.324148 2025] [:error] [pid 25856:tid 25863] [client 98.71.99.66:20411] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSFwxRsTP0wy94zKUvGOVgAAAQU"]
[Sat Nov 22 16:13:58.032426 2025] [:error] [pid 25856:tid 25871] [client 98.71.99.66:20243] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSFwxhsTP0wy94zKUvGOWAAAAQ0"]
[Sat Nov 22 16:13:58.784810 2025] [:error] [pid 53478:tid 53520] [client 98.71.99.66:20337] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSFwxghUYdXBbQswAdTPxgAAAEs"]
[Sat Nov 22 16:13:59.431339 2025] [:error] [pid 53479:tid 53549] [client 98.71.99.66:20325] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSFwx26cicFF3Aas-oRbDAAAAI0"]
[Sat Nov 22 16:14:00.181309 2025] [:error] [pid 53478:tid 53513] [client 98.71.99.66:20334] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSFwyAhUYdXBbQswAdTPyQAAAEQ"]
[Sat Nov 22 16:14:00.827749 2025] [:error] [pid 9547:tid 9555] [client 98.71.99.66:20287] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSFwyNClOR5qk7DoMeF95AAAAUI"]
[Sat Nov 22 16:14:01.799827 2025] [:error] [pid 9547:tid 9576] [client 98.71.99.66:20394] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSFwydClOR5qk7DoMeF95gAAAVc"]
[Sat Nov 22 16:14:02.610907 2025] [:error] [pid 53478:tid 53525] [client 98.71.99.66:20269] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/manager.php"] [unique_id "aSFwyghUYdXBbQswAdTPzAAAAFA"]
[Sat Nov 22 16:14:03.379876 2025] [:error] [pid 9547:tid 9564] [client 98.71.99.66:20255] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/manager.php"] [unique_id "aSFwy9ClOR5qk7DoMeF95wAAAUs"]
[Sat Nov 22 16:14:04.446271 2025] [:error] [pid 9547:tid 9566] [client 98.71.99.66:20315] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/manager.php"] [unique_id "aSFwzNClOR5qk7DoMeF96QAAAU0"]
[Sat Nov 22 16:14:05.258977 2025] [:error] [pid 53477:tid 53492] [client 98.71.99.66:20190] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/manager.php"] [unique_id "aSFwzX7Lu30Ku9O40aKQogAAAAs"]
[Sat Nov 22 16:14:06.405679 2025] [:error] [pid 25856:tid 25877] [client 98.71.99.66:20167] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/js/fm.php"] [unique_id "aSFwzhsTP0wy94zKUvGOXwAAARM"]
[Sat Nov 22 16:14:07.074961 2025] [:error] [pid 25856:tid 25860] [client 98.71.99.66:20342] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/js/fm.php"] [unique_id "aSFwzxsTP0wy94zKUvGOYAAAAQI"]
[Sat Nov 22 16:14:08.075920 2025] [:error] [pid 53478:tid 53523] [client 98.71.99.66:20301] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/js/fm.php"] [unique_id "aSFw0AhUYdXBbQswAdTP0QAAAE4"]
[Sat Nov 22 16:14:08.997838 2025] [:error] [pid 53566:tid 53568] [client 98.71.99.66:20183] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/js/fm.php"] [unique_id "aSFw0MbSHDBkRbwMbd4E_gAAAMA"]
[Sat Nov 22 16:14:09.808725 2025] [:error] [pid 53477:tid 53494] [client 98.71.99.66:20248] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/item.php"] [unique_id "aSFw0X7Lu30Ku9O40aKQqAAAAA0"]
[Sat Nov 22 16:14:10.750899 2025] [:error] [pid 53478:tid 53514] [client 98.71.99.66:20225] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/item.php"] [unique_id "aSFw0ghUYdXBbQswAdTP1gAAAEU"]
[Sat Nov 22 16:14:11.516444 2025] [:error] [pid 53479:tid 53544] [client 98.71.99.66:20196] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/item.php"] [unique_id "aSFw026cicFF3Aas-oRbHAAAAIg"]
[Sat Nov 22 16:14:12.381213 2025] [:error] [pid 53477:tid 53483] [client 98.71.99.66:20326] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/item.php"] [unique_id "aSFw1H7Lu30Ku9O40aKQqwAAAAI"]
[Sat Nov 22 16:14:13.236568 2025] [:error] [pid 53566:tid 53580] [client 98.71.99.66:20467] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSFw1cbSHDBkRbwMbd4FAgAAAMw"]
[Sat Nov 22 16:14:13.968634 2025] [:error] [pid 9547:tid 9554] [client 98.71.99.66:20312] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSFw1dClOR5qk7DoMeF98AAAAUE"]
[Sat Nov 22 16:14:15.192692 2025] [:error] [pid 53566:tid 53591] [client 98.71.99.66:20336] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSFw18bSHDBkRbwMbd4FBQAAANc"]
[Sat Nov 22 16:14:15.956318 2025] [:error] [pid 53479:tid 53540] [client 98.71.99.66:20235] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSFw126cicFF3Aas-oRbIgAAAIQ"]
[Sat Nov 22 16:14:16.765108 2025] [:error] [pid 53479:tid 53554] [client 98.71.99.66:20240] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/404.php"] [unique_id "aSFw2G6cicFF3Aas-oRbJAAAAJI"]
[Sat Nov 22 16:14:17.449822 2025] [:error] [pid 9547:tid 9577] [client 98.71.99.66:20331] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/404.php"] [unique_id "aSFw2dClOR5qk7DoMeF9-QAAAVg"]
[Sat Nov 22 16:14:18.421620 2025] [:error] [pid 53566:tid 53592] [client 98.71.99.66:20170] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/404.php"] [unique_id "aSFw2sbSHDBkRbwMbd4FCAAAANg"]
[Sat Nov 22 16:14:19.187039 2025] [:error] [pid 53477:tid 53482] [client 98.71.99.66:20238] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/404.php"] [unique_id "aSFw237Lu30Ku9O40aKQrQAAAAE"]
[Sat Nov 22 16:14:19.920150 2025] [:error] [pid 53479:tid 53551] [client 98.71.99.66:20266] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/mail.php"] [unique_id "aSFw226cicFF3Aas-oRbLAAAAI8"]
[Sat Nov 22 16:14:20.822147 2025] [:error] [pid 53566:tid 53582] [client 98.71.99.66:20249] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/mail.php"] [unique_id "aSFw3MbSHDBkRbwMbd4FCgAAAM4"]
[Sat Nov 22 16:14:21.722779 2025] [:error] [pid 53478:tid 53517] [client 98.71.99.66:20195] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/mail.php"] [unique_id "aSFw3QhUYdXBbQswAdTP6QAAAEg"]
[Sat Nov 22 16:14:22.852045 2025] [:error] [pid 53566:tid 53572] [client 98.71.99.66:20319] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/mail.php"] [unique_id "aSFw3sbSHDBkRbwMbd4FDQAAAMQ"]
[Sat Nov 22 16:14:23.928238 2025] [:error] [pid 53477:tid 53501] [client 98.71.99.66:20160] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aSFw337Lu30Ku9O40aKQrwAAABQ"]
[Sat Nov 22 16:14:24.739099 2025] [:error] [pid 53566:tid 53578] [client 98.71.99.66:20319] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aSFw4MbSHDBkRbwMbd4FDwAAAMo"]
[Sat Nov 22 16:14:25.762789 2025] [:error] [pid 53478:tid 53520] [client 98.71.99.66:20274] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aSFw4QhUYdXBbQswAdTP8QAAAEs"]
[Sat Nov 22 16:14:26.644501 2025] [:error] [pid 53477:tid 53492] [client 98.71.99.66:20316] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aSFw4n7Lu30Ku9O40aKQsQAAAAs"]
[Sat Nov 22 16:14:27.805149 2025] [:error] [pid 53477:tid 53496] [client 98.71.99.66:20332] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sx.php"] [unique_id "aSFw437Lu30Ku9O40aKQswAAAA8"]
[Sat Nov 22 16:14:28.666611 2025] [:error] [pid 53479:tid 53559] [client 98.71.99.66:20233] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sx.php"] [unique_id "aSFw5G6cicFF3Aas-oRbOgAAAJc"]
[Sat Nov 22 16:14:29.458795 2025] [:error] [pid 53477:tid 53505] [client 98.71.99.66:20270] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sx.php"] [unique_id "aSFw5X7Lu30Ku9O40aKQtQAAABg"]
[Sat Nov 22 16:14:30.336090 2025] [:error] [pid 25856:tid 25865] [client 98.71.99.66:20192] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sx.php"] [unique_id "aSFw5hsTP0wy94zKUvGOcwAAAQc"]
[Sat Nov 22 16:14:31.382806 2025] [:error] [pid 25856:tid 25875] [client 98.71.99.66:20168] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSFw5xsTP0wy94zKUvGOdQAAARE"]
[Sat Nov 22 16:14:32.117317 2025] [:error] [pid 25856:tid 25870] [client 98.71.99.66:20176] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSFw6BsTP0wy94zKUvGOdgAAAQw"]
[Sat Nov 22 16:14:33.057875 2025] [:error] [pid 53566:tid 53591] [client 98.71.99.66:20242] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSFw6cbSHDBkRbwMbd4FFAAAANc"]
[Sat Nov 22 16:14:34.023225 2025] [:error] [pid 9547:tid 9575] [client 98.71.99.66:20346] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSFw6tClOR5qk7DoMeF-BQAAAVY"]
[Sat Nov 22 16:14:34.662109 2025] [:error] [pid 9547:tid 9553] [client 98.71.99.66:20120] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/article.php"] [unique_id "aSFw6tClOR5qk7DoMeF-BgAAAUA"]
[Sat Nov 22 16:14:35.526017 2025] [:error] [pid 25856:tid 25868] [client 98.71.99.66:20171] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/article.php"] [unique_id "aSFw6xsTP0wy94zKUvGOeQAAAQo"]
[Sat Nov 22 16:14:48.867478 2025] [:error] [pid 25856:tid 25875] [client 98.71.99.66:20452] [client 98.71.99.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aSFw-BsTP0wy94zKUvGOggAAARE"]
[Sat Nov 22 16:14:51.570307 2025] [:error] [pid 25856:tid 25858] [client 98.71.99.66:20281] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gmo.php"] [unique_id "aSFw-xsTP0wy94zKUvGOgwAAAQA"]
[Sat Nov 22 16:14:52.624892 2025] [:error] [pid 25856:tid 25881] [client 98.71.99.66:20405] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gmo.php"] [unique_id "aSFw_BsTP0wy94zKUvGOhQAAARc"]
[Sat Nov 22 16:14:53.499815 2025] [:error] [pid 53477:tid 53502] [client 98.71.99.66:20254] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gmo.php"] [unique_id "aSFw_X7Lu30Ku9O40aKQygAAABU"]
[Sat Nov 22 16:14:54.427500 2025] [:error] [pid 9547:tid 9571] [client 98.71.99.66:20309] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gmo.php"] [unique_id "aSFw_tClOR5qk7DoMeF-GgAAAVI"]
[Sat Nov 22 16:14:55.085072 2025] [:error] [pid 9547:tid 9576] [client 98.71.99.66:20187] [client 98.71.99.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSFw_9ClOR5qk7DoMeF-HgAAAVc"]
[Sat Nov 22 16:14:56.049425 2025] [:error] [pid 53477:tid 53482] [client 98.71.99.66:20097] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/css/index.php"] [unique_id "aSFxAH7Lu30Ku9O40aKQywAAAAE"]
[Sat Nov 22 16:14:57.458236 2025] [:error] [pid 53566:tid 53574] [client 98.71.99.66:20236] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/css/index.php"] [unique_id "aSFxAcbSHDBkRbwMbd4FJQAAAMY"]
[Sat Nov 22 16:14:58.243014 2025] [:error] [pid 53477:tid 53495] [client 98.71.99.66:20194] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/css/index.php"] [unique_id "aSFxAn7Lu30Ku9O40aKQzgAAAA4"]
[Sat Nov 22 16:14:59.155587 2025] [:error] [pid 53478:tid 53511] [client 98.71.99.66:20259] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSFxAwhUYdXBbQswAdTQTwAAAEI"]
[Sat Nov 22 16:15:00.139852 2025] [:error] [pid 53478:tid 53520] [client 98.71.99.66:20237] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSFxBAhUYdXBbQswAdTQVAAAAEs"]
[Sat Nov 22 16:15:00.860831 2025] [:error] [pid 53479:tid 53552] [client 98.71.99.66:20353] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSFxBG6cicFF3Aas-oRbbwAAAJA"]
[Sat Nov 22 16:15:01.529009 2025] [:error] [pid 53479:tid 53557] [client 98.71.99.66:20418] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSFxBW6cicFF3Aas-oRbcAAAAJU"]
[Sat Nov 22 16:15:02.482521 2025] [:error] [pid 53479:tid 53549] [client 98.71.99.66:20369] [client 98.71.99.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aSFxBm6cicFF3Aas-oRbcgAAAI0"]
[Sat Nov 22 16:15:03.935986 2025] [:error] [pid 53478:tid 53527] [client 98.71.99.66:20227] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aSFxBwhUYdXBbQswAdTQYQAAAFI"]
[Sat Nov 22 16:15:05.175882 2025] [:error] [pid 9547:tid 9566] [client 98.71.99.66:20107] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aSFxCdClOR5qk7DoMeF-KAAAAU0"]
[Sat Nov 22 16:15:06.208654 2025] [:error] [pid 53566:tid 53575] [client 98.71.99.66:20132] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aSFxCsbSHDBkRbwMbd4FMQAAAMc"]
[Sat Nov 22 16:15:07.229402 2025] [:error] [pid 53477:tid 53497] [client 98.71.99.66:20367] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aSFxC37Lu30Ku9O40aKQ1gAAABA"]
[Sat Nov 22 16:15:07.783783 2025] [:error] [pid 53479:tid 53542] [client 98.71.99.66:20175] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aSFxC26cicFF3Aas-oRbeQAAAIY"]
[Sat Nov 22 16:15:08.489974 2025] [:error] [pid 53566:tid 53568] [client 98.71.99.66:20105] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aSFxDMbSHDBkRbwMbd4FOAAAAMA"]
[Sat Nov 22 16:15:09.230953 2025] [:error] [pid 53566:tid 53577] [client 98.71.99.66:20229] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aSFxDcbSHDBkRbwMbd4FOQAAAMk"]
[Sat Nov 22 16:15:09.961036 2025] [:error] [pid 9547:tid 9554] [client 98.71.99.66:20280] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aSFxDdClOR5qk7DoMeF-LQAAAUE"]
[Sat Nov 22 16:15:10.604224 2025] [:error] [pid 9547:tid 9557] [client 98.71.99.66:20180] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSFxDtClOR5qk7DoMeF-LwAAAUQ"]
[Sat Nov 22 16:15:11.409102 2025] [:error] [pid 9547:tid 9571] [client 98.71.99.66:20423] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSFxD9ClOR5qk7DoMeF-NAAAAVI"]
[Sat Nov 22 16:15:12.459389 2025] [:error] [pid 53479:tid 53538] [client 98.71.99.66:20209] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSFxEG6cicFF3Aas-oRbfAAAAII"]
[Sat Nov 22 16:15:13.067288 2025] [:error] [pid 9547:tid 9554] [client 98.71.99.66:20256] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSFxEdClOR5qk7DoMeF-PgAAAUE"]
[Sat Nov 22 16:15:14.177650 2025] [:error] [pid 53479:tid 53557] [client 98.71.99.66:20188] [client 98.71.99.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "aSFxEm6cicFF3Aas-oRbhQAAAJU"]
[Sat Nov 22 16:15:14.977367 2025] [:error] [pid 9547:tid 9563] [client 98.71.99.66:20117] [client 98.71.99.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSFxEtClOR5qk7DoMeF-QwAAAUo"]
[Sat Nov 22 16:15:16.213480 2025] [:error] [pid 9547:tid 9572] [client 98.71.99.66:20475] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/index/function.php"] [unique_id "aSFxFNClOR5qk7DoMeF-RgAAAVM"]
[Sat Nov 22 16:15:17.015765 2025] [:error] [pid 9547:tid 9574] [client 98.71.99.66:20286] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/index/function.php"] [unique_id "aSFxFdClOR5qk7DoMeF-RwAAAVU"]
[Sat Nov 22 16:15:18.012685 2025] [:error] [pid 9547:tid 9573] [client 98.71.99.66:20260] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/index/function.php"] [unique_id "aSFxFtClOR5qk7DoMeF-SQAAAVQ"]
[Sat Nov 22 16:15:19.139146 2025] [:error] [pid 25856:tid 25873] [client 98.71.99.66:20340] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/index/function.php"] [unique_id "aSFxFxsTP0wy94zKUvGOkwAAAQ8"]
[Sat Nov 22 16:15:19.947278 2025] [:error] [pid 9547:tid 9564] [client 98.71.99.66:20362] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aSFxF9ClOR5qk7DoMeF-TQAAAUs"]
[Sat Nov 22 16:15:20.702346 2025] [:error] [pid 53566:tid 53572] [client 98.71.99.66:20282] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aSFxGMbSHDBkRbwMbd4FRgAAAMQ"]
[Sat Nov 22 16:15:21.919081 2025] [:error] [pid 53479:tid 53547] [client 98.71.99.66:20471] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aSFxGW6cicFF3Aas-oRbkgAAAIs"]
[Sat Nov 22 16:15:22.786920 2025] [:error] [pid 53477:tid 53489] [client 98.71.99.66:20198] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aSFxGn7Lu30Ku9O40aKQ6AAAAAg"]
[Sat Nov 22 16:15:23.656676 2025] [:error] [pid 53479:tid 53552] [client 98.71.99.66:20427] [client 98.71.99.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aSFxG26cicFF3Aas-oRblwAAAJA"]
[Sat Nov 22 16:15:24.961650 2025] [:error] [pid 25856:tid 25867] [client 98.71.99.66:20143] [client 98.71.99.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSFxHBsTP0wy94zKUvGOnAAAAQk"]
[Sat Nov 22 16:15:26.742361 2025] [:error] [pid 53479:tid 53557] [client 98.71.99.66:20363] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww1.php"] [unique_id "aSFxHm6cicFF3Aas-oRbnAAAAJU"]
[Sat Nov 22 16:15:27.880750 2025] [:error] [pid 53479:tid 53541] [client 98.71.99.66:20445] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww1.php"] [unique_id "aSFxH26cicFF3Aas-oRbnwAAAIU"]
[Sat Nov 22 16:15:28.824432 2025] [:error] [pid 25856:tid 25880] [client 98.71.99.66:20445] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww1.php"] [unique_id "aSFxIBsTP0wy94zKUvGOngAAARY"]
[Sat Nov 22 16:15:29.822448 2025] [:error] [pid 53477:tid 53505] [client 98.71.99.66:20377] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww1.php"] [unique_id "aSFxIX7Lu30Ku9O40aKQ8QAAABg"]
[Sat Nov 22 16:15:31.357424 2025] [:error] [pid 53479:tid 53559] [client 98.71.99.66:20458] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/qqq.php"] [unique_id "aSFxI26cicFF3Aas-oRbpwAAAJc"]
[Sat Nov 22 16:15:33.085360 2025] [:error] [pid 25856:tid 25877] [client 98.71.99.66:20174] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/qqq.php"] [unique_id "aSFxJRsTP0wy94zKUvGOowAAARM"]
[Sat Nov 22 16:15:34.601898 2025] [:error] [pid 53566:tid 53580] [client 98.71.99.66:20466] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/qqq.php"] [unique_id "aSFxJsbSHDBkRbwMbd4FTwAAAMw"]
[Sat Nov 22 16:15:35.667176 2025] [:error] [pid 25856:tid 25869] [client 98.71.99.66:20441] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/qqq.php"] [unique_id "aSFxJxsTP0wy94zKUvGOpgAAAQs"]
[Sat Nov 22 16:15:36.757091 2025] [:error] [pid 53566:tid 53575] [client 98.71.99.66:20419] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/about/function.php"] [unique_id "aSFxKMbSHDBkRbwMbd4FUwAAAMc"]
[Sat Nov 22 16:15:37.994928 2025] [:error] [pid 53477:tid 53482] [client 98.71.99.66:20324] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/about/function.php"] [unique_id "aSFxKX7Lu30Ku9O40aKQ_AAAAAE"]
[Sat Nov 22 16:15:39.437115 2025] [:error] [pid 25856:tid 25865] [client 98.71.99.66:20217] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/about/function.php"] [unique_id "aSFxKxsTP0wy94zKUvGOqAAAAQc"]
[Sat Nov 22 16:15:40.638615 2025] [:error] [pid 25856:tid 25867] [client 98.71.99.66:20262] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/about/function.php"] [unique_id "aSFxLBsTP0wy94zKUvGOqQAAAQk"]
[Sat Nov 22 16:15:41.334105 2025] [:error] [pid 53566:tid 53568] [client 98.71.99.66:20200] [client 98.71.99.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSFxLcbSHDBkRbwMbd4FWAAAAMA"]
[Sat Nov 22 16:15:42.447479 2025] [:error] [pid 53478:tid 53529] [client 98.71.99.66:20447] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/admin/function.php"] [unique_id "aSFxLghUYdXBbQswAdTQoQAAAFQ"]
[Sat Nov 22 16:15:43.708804 2025] [:error] [pid 9547:tid 9572] [client 98.71.99.66:20279] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/admin/function.php"] [unique_id "aSFxL9ClOR5qk7DoMeF-dgAAAVM"]
[Sat Nov 22 16:15:44.712017 2025] [:error] [pid 53479:tid 53544] [client 98.71.99.66:20433] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/admin/function.php"] [unique_id "aSFxMG6cicFF3Aas-oRbtgAAAIg"]
[Sat Nov 22 16:15:45.748595 2025] [:error] [pid 53477:tid 53504] [client 98.71.99.66:20296] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/admin/function.php"] [unique_id "aSFxMX7Lu30Ku9O40aKRAAAAABc"]
[Sat Nov 22 16:15:46.817950 2025] [:error] [pid 25856:tid 25858] [client 98.71.99.66:20442] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSFxMhsTP0wy94zKUvGOrwAAAQA"]
[Sat Nov 22 16:15:48.983299 2025] [:error] [pid 9547:tid 9560] [client 98.71.99.66:20368] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSFxNNClOR5qk7DoMeF-gwAAAUc"]
[Sat Nov 22 16:15:50.289536 2025] [proxy_fcgi:error] [pid 53477:tid 53490] [client 98.71.99.66:20357] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 16:15:58.364694 2025] [:error] [pid 53479:tid 53536] [client 98.71.99.66:20099] [client 98.71.99.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSFxPm6cicFF3Aas-oRbwwAAAIA"]
[Sat Nov 22 16:16:06.439826 2025] [:error] [pid 53566:tid 53581] [client 98.71.99.66:20186] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class.php"] [unique_id "aSFxRsbSHDBkRbwMbd4FbQAAAM0"]
[Sat Nov 22 16:16:07.598167 2025] [:error] [pid 53479:tid 53542] [client 98.71.99.66:20163] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class.php"] [unique_id "aSFxR26cicFF3Aas-oRbzwAAAIY"]
[Sat Nov 22 16:16:08.469102 2025] [:error] [pid 53479:tid 53547] [client 98.71.99.66:20177] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class.php"] [unique_id "aSFxSG6cicFF3Aas-oRb0gAAAIs"]
[Sat Nov 22 16:16:10.086314 2025] [:error] [pid 53477:tid 53498] [client 98.71.99.66:20479] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class.php"] [unique_id "aSFxSn7Lu30Ku9O40aKRGgAAABE"]
[Sat Nov 22 16:16:11.496180 2025] [:error] [pid 9547:tid 9563] [client 98.71.99.66:20465] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bless5.php"] [unique_id "aSFxS9ClOR5qk7DoMeF-rwAAAUo"]
[Sat Nov 22 16:16:12.590873 2025] [:error] [pid 53477:tid 53492] [client 98.71.99.66:20212] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bless5.php"] [unique_id "aSFxTH7Lu30Ku9O40aKRHAAAAAs"]
[Sat Nov 22 16:16:13.446991 2025] [:error] [pid 53477:tid 53505] [client 98.71.99.66:20303] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bless5.php"] [unique_id "aSFxTX7Lu30Ku9O40aKRHgAAABg"]
[Sat Nov 22 16:16:14.699929 2025] [:error] [pid 53478:tid 53518] [client 98.71.99.66:20425] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bless5.php"] [unique_id "aSFxTghUYdXBbQswAdTQwgAAAEk"]
[Sat Nov 22 16:16:15.743853 2025] [:error] [pid 25856:tid 25865] [client 98.71.99.66:20193] [client 98.71.99.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSFxTxsTP0wy94zKUvGOxQAAAQc"]
[Sat Nov 22 16:16:16.786928 2025] [:error] [pid 9547:tid 9575] [client 98.71.99.66:20329] [client 98.71.99.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aSFxUNClOR5qk7DoMeF-tgAAAVY"]
[Sat Nov 22 16:16:17.596379 2025] [:error] [pid 53478:tid 53526] [client 98.71.99.66:20211] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "aSFxUQhUYdXBbQswAdTQxQAAAFE"]
[Sat Nov 22 16:16:18.215105 2025] [:error] [pid 25856:tid 25880] [client 98.71.99.66:20121] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "aSFxUhsTP0wy94zKUvGOxgAAARY"]
[Sat Nov 22 16:16:19.162123 2025] [:error] [pid 53478:tid 53521] [client 98.71.99.66:20388] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "aSFxUwhUYdXBbQswAdTQyQAAAEw"]
[Sat Nov 22 16:16:20.142977 2025] [:error] [pid 9547:tid 9564] [client 98.71.99.66:20232] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "aSFxVNClOR5qk7DoMeF-ugAAAUs"]
[Sat Nov 22 16:16:21.279768 2025] [:error] [pid 9547:tid 9574] [client 98.71.99.66:20385] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bge.php"] [unique_id "aSFxVdClOR5qk7DoMeF-vgAAAVU"]
[Sat Nov 22 16:16:22.603753 2025] [:error] [pid 25856:tid 25862] [client 98.71.99.66:20457] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bge.php"] [unique_id "aSFxVhsTP0wy94zKUvGOyQAAAQQ"]
[Sat Nov 22 16:16:23.908558 2025] [:error] [pid 25856:tid 25877] [client 98.71.99.66:20327] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bge.php"] [unique_id "aSFxVxsTP0wy94zKUvGOzAAAARM"]
[Sat Nov 22 16:16:24.870909 2025] [:error] [pid 9547:tid 9571] [client 98.71.99.66:20213] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bge.php"] [unique_id "aSFxWNClOR5qk7DoMeF-wQAAAVI"]
[Sat Nov 22 16:16:26.466866 2025] [:error] [pid 9547:tid 9554] [client 98.71.99.66:20355] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ifm.php"] [unique_id "aSFxWtClOR5qk7DoMeF-wwAAAUE"]
[Sat Nov 22 16:16:27.347956 2025] [:error] [pid 25856:tid 25866] [client 98.71.99.66:20454] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ifm.php"] [unique_id "aSFxWxsTP0wy94zKUvGO0gAAAQg"]
[Sat Nov 22 16:16:28.753925 2025] [:error] [pid 25856:tid 25871] [client 98.71.99.66:20455] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ifm.php"] [unique_id "aSFxXBsTP0wy94zKUvGO1QAAAQ0"]
[Sat Nov 22 16:16:30.320202 2025] [:error] [pid 9547:tid 9562] [client 98.71.99.66:20358] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ifm.php"] [unique_id "aSFxXtClOR5qk7DoMeF-xwAAAUk"]
[Sat Nov 22 16:16:31.361933 2025] [:error] [pid 53566:tid 53587] [client 98.71.99.66:20435] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww5.php"] [unique_id "aSFxX8bSHDBkRbwMbd4FewAAANM"]
[Sat Nov 22 16:16:32.311685 2025] [:error] [pid 9547:tid 9574] [client 98.71.99.66:20166] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww5.php"] [unique_id "aSFxYNClOR5qk7DoMeF-ywAAAVU"]
[Sat Nov 22 16:16:33.102104 2025] [:error] [pid 9547:tid 9565] [client 98.71.99.66:20352] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww5.php"] [unique_id "aSFxYdClOR5qk7DoMeF-zAAAAUw"]
[Sat Nov 22 16:16:33.912701 2025] [:error] [pid 53479:tid 53546] [client 98.71.99.66:20214] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww5.php"] [unique_id "aSFxYW6cicFF3Aas-oRb9gAAAIo"]
[Sat Nov 22 16:16:35.020749 2025] [:error] [pid 25856:tid 25869] [client 98.71.99.66:20410] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/thxt.php"] [unique_id "aSFxYxsTP0wy94zKUvGO4QAAAQs"]
[Sat Nov 22 16:16:36.069297 2025] [:error] [pid 53566:tid 53588] [client 98.71.99.66:20428] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/thxt.php"] [unique_id "aSFxZMbSHDBkRbwMbd4FfwAAANQ"]
[Sat Nov 22 16:16:36.934946 2025] [:error] [pid 25856:tid 25878] [client 98.71.99.66:20103] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/thxt.php"] [unique_id "aSFxZBsTP0wy94zKUvGO5AAAARQ"]
[Sat Nov 22 16:16:37.802624 2025] [:error] [pid 9547:tid 9567] [client 98.71.99.66:20474] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/thxt.php"] [unique_id "aSFxZdClOR5qk7DoMeF-0AAAAU4"]
[Sat Nov 22 16:16:39.169484 2025] [:error] [pid 53477:tid 53488] [client 98.71.99.66:20228] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/kairolin.php"] [unique_id "aSFxZ37Lu30Ku9O40aKROwAAAAc"]
[Sat Nov 22 16:16:40.312928 2025] [:error] [pid 25856:tid 25875] [client 98.71.99.66:20464] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/kairolin.php"] [unique_id "aSFxaBsTP0wy94zKUvGO7AAAARE"]
[Sat Nov 22 16:16:41.419773 2025] [:error] [pid 25856:tid 25863] [client 98.71.99.66:20436] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/kairolin.php"] [unique_id "aSFxaRsTP0wy94zKUvGO7QAAAQU"]
[Sat Nov 22 16:16:43.469291 2025] [:error] [pid 25856:tid 25874] [client 98.71.99.66:20468] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/kairolin.php"] [unique_id "aSFxaxsTP0wy94zKUvGO8AAAARA"]
[Sat Nov 22 16:16:44.495164 2025] [:error] [pid 25856:tid 25878] [client 98.71.99.66:20446] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/siln.php"] [unique_id "aSFxbBsTP0wy94zKUvGO8wAAARQ"]
[Sat Nov 22 16:16:45.528050 2025] [:error] [pid 53566:tid 53571] [client 98.71.99.66:20374] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/siln.php"] [unique_id "aSFxbcbSHDBkRbwMbd4FhgAAAMM"]
[Sat Nov 22 16:16:46.765225 2025] [:error] [pid 53477:tid 53501] [client 98.71.99.66:20356] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/siln.php"] [unique_id "aSFxbn7Lu30Ku9O40aKRRAAAABQ"]
[Sat Nov 22 16:16:48.751207 2025] [:error] [pid 53478:tid 53515] [client 98.71.99.66:20356] [client 98.71.99.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/siln.php"] [unique_id "aSFxcAhUYdXBbQswAdTQ7AAAAEY"]
[Sat Nov 22 17:19:08.212790 2025] [:error] [pid 44259:tid 44286] [client 176.123.5.253:28656] [client 176.123.5.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.123.5.253, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aSGADHXe1xL-_YOdRmRMogAAAZg"]
[Sat Nov 22 17:19:14.799505 2025] [:error] [pid 53479:tid 53551] [client 95.164.6.232:57142] [client 95.164.6.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.164.6.232, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aSGAEm6cicFF3Aas-oR0UgAAAI8"]
[Sun Nov 23 00:26:47.769247 2025] [:error] [pid 39719:tid 39798] [client 23.162.200.227:47614] [client 23.162.200.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 23.162.200.227, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aSHkRxmP4k0tY5Yex-WsOwAAARY"]
[Sun Nov 23 00:27:00.742238 2025] [:error] [pid 39942:tid 40014] [client 172.82.67.155:35044] [client 172.82.67.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.82.67.155, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aSHkVKNupsOsQf9D2gw5ygAAAVM"]
[Sun Nov 23 02:52:12.097577 2025] [:error] [pid 39719:tid 39798] [client 216.73.163.144:22099] [client 216.73.163.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSIGXBmP4k0tY5Yex-XmdAAAARY"]
[Sun Nov 23 02:52:15.118683 2025] [:error] [pid 39713:tid 39727] [client 45.131.194.122:45865] [client 45.131.194.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aSIGX0Ugrb325CIAjPq4cwAAAAY"]
[Sun Nov 23 02:52:20.502685 2025] [:error] [pid 8816:tid 8900] [client 216.73.163.151:30645] [client 216.73.163.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aSIGZJb4RIAN-_BXnHmL1wAAAI8"]
[Sun Nov 23 02:52:23.519120 2025] [:error] [pid 39713:tid 39729] [client 216.73.163.157:39073] [client 216.73.163.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aSIGZ0Ugrb325CIAjPq4iAAAAAg"]
[Sun Nov 23 02:52:32.076648 2025] [:error] [pid 8816:tid 8906] [client 216.73.163.119:21975] [client 216.73.163.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aSIGcJb4RIAN-_BXnHmL8wAAAJU"]
[Sun Nov 23 02:52:33.564096 2025] [:error] [pid 39942:tid 40011] [client 216.73.163.143:34329] [client 216.73.163.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSIGcaNupsOsQf9D2gx_GQAAAVA"]
[Sun Nov 23 02:52:34.267224 2025] [:error] [pid 39718:tid 39761] [client 216.73.163.155:24351] [client 216.73.163.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aSIGcgQ3B_uDoeItNmOHCQAAAEw"]
[Sun Nov 23 02:52:35.045690 2025] [:error] [pid 39718:tid 39756] [client 216.73.163.156:33737] [client 216.73.163.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aSIGcwQ3B_uDoeItNmOHDAAAAEc"]
[Sun Nov 23 02:52:35.802709 2025] [:error] [pid 39718:tid 39749] [client 45.146.54.138:33909] [client 45.146.54.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aSIGcwQ3B_uDoeItNmOHDQAAAEA"]
[Sun Nov 23 02:52:36.628296 2025] [:error] [pid 39713:tid 39723] [client 216.73.163.149:32913] [client 216.73.163.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aSIGdEUgrb325CIAjPq4lwAAAAI"]
[Sun Nov 23 02:52:38.176751 2025] [:error] [pid 39713:tid 39744] [client 216.73.163.160:40957] [client 216.73.163.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aSIGdkUgrb325CIAjPq4nAAAABc"]
[Sun Nov 23 02:52:40.073775 2025] [:error] [pid 39713:tid 39745] [client 45.146.54.134:47365] [client 45.146.54.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "aSIGeEUgrb325CIAjPq4owAAABg"]
[Sun Nov 23 02:52:42.386716 2025] [:error] [pid 8816:tid 8906] [client 45.146.54.136:44895] [client 45.146.54.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSIGepb4RIAN-_BXnHmMBAAAAJU"]
[Sun Nov 23 02:52:46.121837 2025] [:error] [pid 39718:tid 39758] [client 216.73.163.150:40055] [client 216.73.163.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aSIGfgQ3B_uDoeItNmOHFgAAAEk"]
[Sun Nov 23 02:52:47.634075 2025] [:error] [pid 8816:tid 8901] [client 45.146.54.138:21153] [client 45.146.54.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSIGf5b4RIAN-_BXnHmMCwAAAJA"]
[Sun Nov 23 02:52:53.130146 2025] [:error] [pid 8816:tid 8903] [client 216.73.163.116:38477] [client 216.73.163.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aSIGhZb4RIAN-_BXnHmMFgAAAJI"]
[Sun Nov 23 02:52:56.009007 2025] [:error] [pid 8816:tid 8898] [client 216.73.163.153:51331] [client 216.73.163.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aSIGiJb4RIAN-_BXnHmMGgAAAI0"]
[Sun Nov 23 02:52:59.577080 2025] [:error] [pid 39713:tid 39727] [client 216.73.163.134:64211] [client 216.73.163.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aSIGi0Ugrb325CIAjPq4rQAAAAY"]
[Sun Nov 23 02:53:01.189394 2025] [:error] [pid 8816:tid 8908] [client 216.73.163.130:38937] [client 216.73.163.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSIGjZb4RIAN-_BXnHmMJgAAAJc"]
[Sun Nov 23 02:53:05.087915 2025] [:error] [pid 39713:tid 39732] [client 216.73.163.132:55341] [client 216.73.163.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSIGkUUgrb325CIAjPq4tQAAAAs"]
[Sun Nov 23 02:53:07.592889 2025] [:error] [pid 39718:tid 39752] [client 216.73.163.159:57801] [client 216.73.163.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSIGkwQ3B_uDoeItNmOHKgAAAEM"]
[Sun Nov 23 02:53:09.184775 2025] [:error] [pid 39942:tid 39995] [client 216.73.163.149:53799] [client 216.73.163.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSIGlaNupsOsQf9D2gx_QQAAAUE"]
[Sun Nov 23 02:53:09.913969 2025] [:error] [pid 39942:tid 40006] [client 216.73.163.147:43329] [client 216.73.163.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aSIGlaNupsOsQf9D2gx_RQAAAUs"]
[Sun Nov 23 02:53:10.654977 2025] [:error] [pid 39713:tid 39742] [client 216.73.163.118:44903] [client 216.73.163.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSIGlkUgrb325CIAjPq4uAAAABU"]
[Sun Nov 23 02:53:14.930248 2025] [:error] [pid 39713:tid 39736] [client 216.73.163.156:63443] [client 216.73.163.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aSIGmkUgrb325CIAjPq4vgAAAA8"]
[Sun Nov 23 02:53:15.626382 2025] [:error] [pid 39718:tid 39768] [client 216.73.163.141:39455] [client 216.73.163.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aSIGmwQ3B_uDoeItNmOHMQAAAFM"]
[Sun Nov 23 02:53:16.337282 2025] [:error] [pid 39942:tid 39998] [client 216.73.163.133:33927] [client 216.73.163.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSIGnKNupsOsQf9D2gx_VwAAAUM"]
[Sun Nov 23 02:53:24.053167 2025] [:error] [pid 39942:tid 40016] [client 216.73.163.157:59541] [client 216.73.163.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aSIGpKNupsOsQf9D2gx_ZAAAAVU"]
[Sun Nov 23 02:53:27.028166 2025] [:error] [pid 8816:tid 8905] [client 216.73.163.131:61167] [client 216.73.163.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.131, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aSIGp5b4RIAN-_BXnHmMXAAAAJQ"]
[Sun Nov 23 02:53:38.982416 2025] [:error] [pid 39942:tid 40013] [client 216.73.163.133:23361] [client 216.73.163.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSIGsqNupsOsQf9D2gx_cQAAAVI"]
[Sun Nov 23 02:53:42.602968 2025] [:error] [pid 39719:tid 39777] [client 216.73.163.141:43749] [client 216.73.163.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.141, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aSIGthmP4k0tY5Yex-XnCwAAAQE"]
[Sun Nov 23 02:53:44.170664 2025] [:error] [pid 39942:tid 39995] [client 216.73.163.119:39633] [client 216.73.163.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/item.php"] [unique_id "aSIGuKNupsOsQf9D2gx_eAAAAUE"]
[Sun Nov 23 02:53:51.207198 2025] [:error] [pid 39719:tid 39776] [client 45.146.54.136:55377] [client 45.146.54.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aSIGvxmP4k0tY5Yex-XnGAAAAQA"]
[Sun Nov 23 02:53:58.108221 2025] [:error] [pid 39718:tid 39749] [client 216.73.163.151:35399] [client 216.73.163.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSIGxgQ3B_uDoeItNmOHnQAAAEA"]
[Sun Nov 23 02:54:00.420170 2025] [:error] [pid 39942:tid 39998] [client 45.146.54.135:55735] [client 45.146.54.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aSIGyKNupsOsQf9D2gx_jgAAAUM"]
[Sun Nov 23 02:54:03.433600 2025] [:error] [pid 39719:tid 39795] [client 216.73.163.121:44655] [client 216.73.163.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.121, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aSIGyxmP4k0tY5Yex-XnNQAAARM"]
[Sun Nov 23 02:54:05.617089 2025] [:error] [pid 39942:tid 40008] [client 216.73.163.134:53417] [client 216.73.163.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aSIGzaNupsOsQf9D2gx_ngAAAU0"]
[Sun Nov 23 02:54:21.814856 2025] [:error] [pid 39719:tid 39780] [client 45.146.54.135:28489] [client 45.146.54.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aSIG3RmP4k0tY5Yex-XnRAAAAQQ"]
[Sun Nov 23 02:54:24.839452 2025] [:error] [pid 39713:tid 39730] [client 45.146.54.136:38727] [client 45.146.54.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.146.54.136, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aSIG4EUgrb325CIAjPq5DgAAAAk"]
[Sun Nov 23 02:54:29.337954 2025] [:error] [pid 39942:tid 40014] [client 45.146.54.134:48707] [client 45.146.54.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aSIG5aNupsOsQf9D2gx_uAAAAVM"]
[Sun Nov 23 02:54:30.789750 2025] [:error] [pid 8816:tid 8908] [client 216.73.163.137:52157] [client 216.73.163.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aSIG5pb4RIAN-_BXnHmMyAAAAJc"]
[Sun Nov 23 02:54:33.173490 2025] [:error] [pid 39942:tid 40010] [client 216.73.163.129:47231] [client 216.73.163.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSIG6aNupsOsQf9D2gx_wwAAAU8"]
[Sun Nov 23 02:54:36.175779 2025] [:error] [pid 39719:tid 39781] [client 216.73.163.123:51635] [client 216.73.163.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aSIG7BmP4k0tY5Yex-XnTwAAAQU"]
[Sun Nov 23 02:54:36.877517 2025] [:error] [pid 39719:tid 39793] [client 216.73.163.131:52711] [client 216.73.163.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aSIG7BmP4k0tY5Yex-XnUQAAARE"]
[Sun Nov 23 02:54:41.223771 2025] [:error] [pid 39718:tid 39761] [client 216.73.163.142:56739] [client 216.73.163.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSIG8QQ3B_uDoeItNmOHygAAAEw"]
[Sun Nov 23 02:54:42.677057 2025] [:error] [pid 39718:tid 39766] [client 216.73.163.134:62559] [client 216.73.163.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aSIG8gQ3B_uDoeItNmOHzgAAAFE"]
[Sun Nov 23 02:54:45.536681 2025] [:error] [pid 39942:tid 40007] [client 216.73.163.140:36167] [client 216.73.163.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aSIG9aNupsOsQf9D2gx_ygAAAUw"]
[Sun Nov 23 02:54:48.441188 2025] [:error] [pid 39719:tid 39786] [client 216.73.163.142:55405] [client 216.73.163.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aSIG-BmP4k0tY5Yex-XnXAAAAQo"]
[Sun Nov 23 02:54:50.736659 2025] [:error] [pid 39718:tid 39759] [client 216.73.163.154:53403] [client 216.73.163.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/click.php"] [unique_id "aSIG-gQ3B_uDoeItNmOH0wAAAEo"]
[Sun Nov 23 02:54:54.882051 2025] [:error] [pid 39719:tid 39782] [client 216.73.163.118:33697] [client 216.73.163.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aSIG_hmP4k0tY5Yex-XnZAAAAQY"]
[Sun Nov 23 02:55:01.155775 2025] [:error] [pid 39718:tid 39771] [client 216.73.163.119:50753] [client 216.73.163.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aSIHBQQ3B_uDoeItNmOH4AAAAFY"]
[Sun Nov 23 02:55:01.867094 2025] [:error] [pid 39719:tid 39784] [client 216.73.163.139:31625] [client 216.73.163.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aSIHBRmP4k0tY5Yex-XncAAAAQg"]
[Sun Nov 23 02:55:02.594725 2025] [:error] [pid 39718:tid 39758] [client 216.73.163.132:20079] [client 216.73.163.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aSIHBgQ3B_uDoeItNmOH5wAAAEk"]
[Sun Nov 23 02:55:03.400184 2025] [:error] [pid 39718:tid 39769] [client 45.146.54.130:45221] [client 45.146.54.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aSIHBwQ3B_uDoeItNmOH7gAAAFQ"]
[Sun Nov 23 02:55:04.944304 2025] [:error] [pid 39718:tid 39758] [client 216.73.163.154:25557] [client 216.73.163.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aSIHCAQ3B_uDoeItNmOH-QAAAEk"]
[Sun Nov 23 02:55:05.729188 2025] [:error] [pid 39942:tid 40010] [client 216.73.163.137:60455] [client 216.73.163.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSIHCaNupsOsQf9D2gx_4QAAAU8"]
[Sun Nov 23 02:55:07.971722 2025] [:error] [pid 39713:tid 39724] [client 45.131.194.123:57675] [client 45.131.194.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aSIHC0Ugrb325CIAjPq5VgAAAAM"]
[Sun Nov 23 02:55:08.705138 2025] [:error] [pid 39942:tid 39998] [client 216.73.163.142:25623] [client 216.73.163.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSIHDKNupsOsQf9D2gx_5gAAAUM"]
[Sun Nov 23 02:55:09.391296 2025] [:error] [pid 39713:tid 39738] [client 216.73.163.144:42191] [client 216.73.163.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aSIHDUUgrb325CIAjPq5WgAAABE"]
[Sun Nov 23 02:55:10.147469 2025] [:error] [pid 39942:tid 40011] [client 216.73.163.155:28069] [client 216.73.163.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aSIHDqNupsOsQf9D2gx_6gAAAVA"]
[Sun Nov 23 02:55:11.658195 2025] [:error] [pid 8816:tid 8910] [client 216.73.163.159:28487] [client 216.73.163.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aSIHD5b4RIAN-_BXnHmNBQAAAJg"]
[Sun Nov 23 02:55:13.849593 2025] [:error] [pid 39713:tid 39740] [client 45.146.54.136:49063] [client 45.146.54.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aSIHEUUgrb325CIAjPq5XgAAABM"]
[Sun Nov 23 02:55:17.869200 2025] [:error] [pid 39942:tid 40018] [client 45.146.54.136:58481] [client 45.146.54.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aSIHFaNupsOsQf9D2gx_-gAAAVc"]
[Sun Nov 23 02:55:25.492096 2025] [:error] [pid 39719:tid 39784] [client 45.146.54.138:33283] [client 45.146.54.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aSIHHRmP4k0tY5Yex-XnhgAAAQg"]
[Sun Nov 23 02:55:28.384959 2025] [:error] [pid 39942:tid 39994] [client 216.73.163.139:33309] [client 216.73.163.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aSIHIKNupsOsQf9D2gyABAAAAUA"]
[Sun Nov 23 02:55:29.076968 2025] [:error] [pid 39713:tid 39734] [client 216.73.163.129:59575] [client 216.73.163.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aSIHIUUgrb325CIAjPq5eAAAAA0"]
[Sun Nov 23 02:55:32.684810 2025] [:error] [pid 39718:tid 39760] [client 216.73.163.129:43999] [client 216.73.163.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSIHJAQ3B_uDoeItNmOIawAAAEs"]
[Sun Nov 23 02:55:36.000748 2025] [proxy_fcgi:error] [pid 39713:tid 39729] [client 216.73.163.117:45673] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 02:55:36.382276 2025] [proxy_fcgi:error] [pid 39713:tid 39744] [client 216.73.163.117:45673] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 02:55:36.731414 2025] [proxy_fcgi:error] [pid 39713:tid 39721] [client 216.73.163.117:45673] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 02:55:39.616066 2025] [:error] [pid 39942:tid 39995] [client 216.73.163.119:22267] [client 216.73.163.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSIHK6NupsOsQf9D2gyANAAAAUE"]
[Sun Nov 23 02:55:40.299700 2025] [:error] [pid 39719:tid 39793] [client 216.73.163.154:61007] [client 216.73.163.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aSIHLBmP4k0tY5Yex-XnnQAAARE"]
[Sun Nov 23 02:55:41.012121 2025] [:error] [pid 39942:tid 40014] [client 216.73.163.143:25827] [client 216.73.163.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aSIHLaNupsOsQf9D2gyAOgAAAVM"]
[Sun Nov 23 02:55:41.694258 2025] [:error] [pid 39942:tid 40017] [client 216.73.163.145:53999] [client 216.73.163.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aSIHLaNupsOsQf9D2gyAPQAAAVY"]
[Sun Nov 23 02:55:42.378825 2025] [:error] [pid 39942:tid 40018] [client 45.146.54.135:49875] [client 45.146.54.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aSIHLqNupsOsQf9D2gyAPgAAAVc"]
[Sun Nov 23 02:55:43.078774 2025] [:error] [pid 8816:tid 8894] [client 216.73.163.159:32955] [client 216.73.163.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aSIHL5b4RIAN-_BXnHmNMgAAAIk"]
[Sun Nov 23 02:55:44.538637 2025] [:error] [pid 8816:tid 8884] [client 216.73.163.116:35557] [client 216.73.163.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aSIHMJb4RIAN-_BXnHmNOQAAAIA"]
[Sun Nov 23 02:55:45.230892 2025] [:error] [pid 39713:tid 39739] [client 216.73.163.132:27495] [client 216.73.163.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aSIHMUUgrb325CIAjPq5mAAAABI"]
[Sun Nov 23 02:55:45.937279 2025] [:error] [pid 39719:tid 39789] [client 216.73.163.133:51067] [client 216.73.163.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aSIHMRmP4k0tY5Yex-XnqAAAAQ0"]
[Sun Nov 23 02:55:46.673116 2025] [:error] [pid 39718:tid 39767] [client 216.73.163.150:64911] [client 216.73.163.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aSIHMgQ3B_uDoeItNmOIrgAAAFI"]
[Sun Nov 23 02:55:48.998090 2025] [:error] [pid 39719:tid 39799] [client 216.73.163.134:49637] [client 216.73.163.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aSIHNBmP4k0tY5Yex-XnrgAAARc"]
[Sun Nov 23 02:55:50.671578 2025] [:error] [pid 8816:tid 8892] [client 216.73.163.154:22927] [client 216.73.163.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSIHNpb4RIAN-_BXnHmNSAAAAIg"]
[Sun Nov 23 02:55:52.931745 2025] [:error] [pid 39719:tid 39784] [client 45.131.194.123:52549] [client 45.131.194.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aSIHOBmP4k0tY5Yex-XnvgAAAQg"]
[Sun Nov 23 02:55:55.278936 2025] [:error] [pid 39713:tid 39721] [client 216.73.163.149:52419] [client 216.73.163.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aSIHO0Ugrb325CIAjPq5nQAAAAA"]
[Sun Nov 23 02:55:58.562784 2025] [:error] [pid 39718:tid 39758] [client 216.73.163.133:40789] [client 216.73.163.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aSIHPgQ3B_uDoeItNmOIuwAAAEk"]
[Sun Nov 23 02:56:04.512135 2025] [:error] [pid 39719:tid 39780] [client 216.73.163.118:26121] [client 216.73.163.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSIHRBmP4k0tY5Yex-Xn0wAAAQQ"]
[Sun Nov 23 02:56:06.039803 2025] [:error] [pid 8816:tid 8886] [client 216.73.163.129:57183] [client 216.73.163.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aSIHRpb4RIAN-_BXnHmNbQAAAII"]
[Sun Nov 23 02:56:20.436064 2025] [:error] [pid 39942:tid 40014] [client 216.73.163.121:28017] [client 216.73.163.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aSIHVKNupsOsQf9D2gyAngAAAVM"]
[Sun Nov 23 02:56:21.194991 2025] [:error] [pid 39719:tid 39793] [client 45.146.54.135:38171] [client 45.146.54.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aSIHVRmP4k0tY5Yex-Xn7QAAARE"]
[Sun Nov 23 02:56:21.941498 2025] [:error] [pid 39719:tid 39783] [client 216.73.163.148:64197] [client 216.73.163.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.148, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aSIHVRmP4k0tY5Yex-Xn7gAAAQc"]
[Sun Nov 23 02:56:23.518724 2025] [:error] [pid 39718:tid 39758] [client 216.73.163.159:38659] [client 216.73.163.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aSIHVwQ3B_uDoeItNmOI0gAAAEk"]
[Sun Nov 23 02:56:25.787596 2025] [:error] [pid 8816:tid 8887] [client 45.146.54.138:59583] [client 45.146.54.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aSIHWZb4RIAN-_BXnHmNzgAAAIM"]
[Sun Nov 23 02:56:26.601646 2025] [:error] [pid 39942:tid 40009] [client 216.73.163.122:41563] [client 216.73.163.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSIHWqNupsOsQf9D2gyApwAAAU4"]
[Sun Nov 23 02:56:30.483990 2025] [:error] [pid 39713:tid 39742] [client 45.146.54.136:48803] [client 45.146.54.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSIHXkUgrb325CIAjPq57QAAABU"]
[Sun Nov 23 02:56:32.564050 2025] [:error] [pid 39719:tid 39791] [client 216.73.163.138:59943] [client 216.73.163.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "aSIHYBmP4k0tY5Yex-XoAgAAAQ8"]
[Sun Nov 23 02:56:37.194214 2025] [:error] [pid 39719:tid 39777] [client 216.73.163.134:63019] [client 216.73.163.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aSIHZRmP4k0tY5Yex-XoCQAAAQE"]
[Sun Nov 23 02:56:39.569664 2025] [proxy_fcgi:error] [pid 39719:tid 39782] [client 216.73.163.122:39887] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 02:56:40.740131 2025] [:error] [pid 39718:tid 39756] [client 45.146.54.138:26917] [client 45.146.54.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/function.php"] [unique_id "aSIHaAQ3B_uDoeItNmOI5AAAAEc"]
[Sun Nov 23 02:56:42.689217 2025] [:error] [pid 39942:tid 40019] [client 216.73.163.158:64213] [client 216.73.163.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aSIHaqNupsOsQf9D2gyAvQAAAVg"]
[Sun Nov 23 02:56:44.867950 2025] [:error] [pid 39718:tid 39749] [client 45.146.54.131:47663] [client 45.146.54.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSIHbAQ3B_uDoeItNmOI7gAAAEA"]
[Sun Nov 23 02:56:45.638526 2025] [:error] [pid 39713:tid 39726] [client 45.146.54.133:40681] [client 45.146.54.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aSIHbUUgrb325CIAjPq6AgAAAAU"]
[Sun Nov 23 02:56:54.700724 2025] [:error] [pid 39942:tid 40004] [client 216.73.163.147:28085] [client 216.73.163.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aSIHdqNupsOsQf9D2gyAzwAAAUk"]
[Sun Nov 23 02:56:55.447211 2025] [:error] [pid 39713:tid 39722] [client 216.73.163.122:24727] [client 216.73.163.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aSIHd0Ugrb325CIAjPq6EgAAAAE"]
[Sun Nov 23 02:56:59.274137 2025] [:error] [pid 39718:tid 39760] [client 216.73.163.133:55187] [client 216.73.163.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/index.php"] [unique_id "aSIHewQ3B_uDoeItNmOJDAAAAEs"]
[Sun Nov 23 02:56:59.988403 2025] [:error] [pid 39942:tid 40006] [client 45.146.54.134:24079] [client 45.146.54.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSIHe6NupsOsQf9D2gyA2QAAAUs"]
[Sun Nov 23 02:57:00.695244 2025] [:error] [pid 8816:tid 8892] [client 216.73.163.116:43599] [client 216.73.163.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSIHfJb4RIAN-_BXnHmOAQAAAIg"]
[Sun Nov 23 02:57:05.617082 2025] [:error] [pid 39713:tid 39725] [client 216.73.163.132:25169] [client 216.73.163.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aSIHgUUgrb325CIAjPq6GgAAAAQ"]
[Sun Nov 23 02:57:07.253585 2025] [:error] [pid 39942:tid 40006] [client 216.73.163.121:26103] [client 216.73.163.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSIHg6NupsOsQf9D2gyA5QAAAUs"]
[Sun Nov 23 02:57:14.020114 2025] [:error] [pid 39719:tid 39787] [client 216.73.163.143:34989] [client 216.73.163.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.143, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/js/wp-login.php"] [unique_id "aSIHihmP4k0tY5Yex-XoQgAAAQs"]
[Sun Nov 23 02:57:20.766065 2025] [:error] [pid 39718:tid 39771] [client 216.73.163.117:31341] [client 216.73.163.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSIHkAQ3B_uDoeItNmOJJgAAAFY"]
[Sun Nov 23 02:57:21.507710 2025] [:error] [pid 39713:tid 39736] [client 216.73.163.154:63235] [client 216.73.163.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.154, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aSIHkUUgrb325CIAjPq6LQAAAA8"]
[Sun Nov 23 02:57:30.334739 2025] [proxy_fcgi:error] [pid 39719:tid 39780] [client 216.73.163.139:35749] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 02:57:46.913590 2025] [:error] [pid 39713:tid 39741] [client 216.73.163.139:60177] [client 216.73.163.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aSIHqkUgrb325CIAjPq6WgAAABQ"]
[Sun Nov 23 02:57:50.151506 2025] [:error] [pid 39942:tid 40005] [client 45.146.54.131:35077] [client 45.146.54.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSIHrqNupsOsQf9D2gyBOAAAAUo"]
[Sun Nov 23 02:57:53.254865 2025] [:error] [pid 39942:tid 40019] [client 216.73.163.153:60877] [client 216.73.163.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aSIHsaNupsOsQf9D2gyBOgAAAVg"]
[Sun Nov 23 02:58:01.153996 2025] [:error] [pid 39942:tid 40004] [client 216.73.163.121:26049] [client 216.73.163.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aSIHuaNupsOsQf9D2gyBUAAAAUk"]
[Sun Nov 23 02:58:03.480704 2025] [:error] [pid 39942:tid 40010] [client 216.73.163.137:59307] [client 216.73.163.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSIHu6NupsOsQf9D2gyBVgAAAU8"]
[Sun Nov 23 02:58:04.968007 2025] [:error] [pid 39942:tid 40000] [client 45.146.54.133:23237] [client 45.146.54.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSIHvKNupsOsQf9D2gyBWAAAAUU"]
[Sun Nov 23 02:58:08.716081 2025] [proxy_fcgi:error] [pid 8816:tid 8907] [client 216.73.163.123:43595] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 02:58:09.117030 2025] [proxy_fcgi:error] [pid 8816:tid 8906] [client 216.73.163.123:43595] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 02:58:09.492623 2025] [:error] [pid 8816:tid 8889] [client 216.73.163.123:43595] [client 216.73.163.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSIHwZb4RIAN-_BXnHmOZAAAAIU"]
[Sun Nov 23 02:58:10.196428 2025] [:error] [pid 8816:tid 8896] [client 45.146.54.133:56895] [client 45.146.54.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSIHwpb4RIAN-_BXnHmOZwAAAIs"]
[Sun Nov 23 02:58:16.260393 2025] [:error] [pid 39718:tid 39772] [client 216.73.163.134:23673] [client 216.73.163.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aSIHyAQ3B_uDoeItNmOJdgAAAFc"]
[Sun Nov 23 02:58:17.815683 2025] [:error] [pid 39718:tid 39764] [client 45.146.54.139:33251] [client 45.146.54.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tiny.php"] [unique_id "aSIHyQQ3B_uDoeItNmOJfAAAAE8"]
[Sun Nov 23 02:58:20.804021 2025] [:error] [pid 8816:tid 8908] [client 216.73.163.147:24159] [client 216.73.163.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aSIHzJb4RIAN-_BXnHmOhQAAAJc"]
[Sun Nov 23 02:58:27.028068 2025] [:error] [pid 39942:tid 40019] [client 45.131.194.122:64417] [client 45.131.194.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aSIH06NupsOsQf9D2gyBhAAAAVg"]
[Sun Nov 23 02:58:27.783586 2025] [proxy_fcgi:error] [pid 39719:tid 39786] [client 216.73.163.140:58409] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 02:58:29.741524 2025] [:error] [pid 39942:tid 40004] [client 216.73.163.147:38763] [client 216.73.163.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSIH1aNupsOsQf9D2gyBjAAAAUk"]
[Sun Nov 23 02:58:34.437729 2025] [proxy_fcgi:error] [pid 39713:tid 39735] [client 216.73.163.141:23553] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 02:58:35.624811 2025] [:error] [pid 8816:tid 8891] [client 45.146.54.135:49183] [client 45.146.54.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.146.54.135, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aSIH25b4RIAN-_BXnHmOoQAAAIc"]
[Sun Nov 23 02:58:39.743765 2025] [:error] [pid 39719:tid 39791] [client 45.146.54.132:32391] [client 45.146.54.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aSIH3xmP4k0tY5Yex-XougAAAQ8"]
[Sun Nov 23 02:58:41.215053 2025] [:error] [pid 39713:tid 39745] [client 45.146.54.136:49251] [client 45.146.54.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aSIH4UUgrb325CIAjPq6rQAAABg"]
[Sun Nov 23 02:58:48.321708 2025] [:error] [pid 39719:tid 39791] [client 216.73.163.130:35713] [client 216.73.163.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aSIH6BmP4k0tY5Yex-XoxgAAAQ8"]
[Sun Nov 23 02:58:52.219783 2025] [:error] [pid 8816:tid 8885] [client 45.146.54.131:32601] [client 45.146.54.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aSIH7Jb4RIAN-_BXnHmOzAAAAIE"]
[Sun Nov 23 02:58:53.716122 2025] [:error] [pid 39713:tid 39729] [client 216.73.163.154:45733] [client 216.73.163.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aSIH7UUgrb325CIAjPq6ugAAAAg"]
[Sun Nov 23 02:58:58.246022 2025] [:error] [pid 39713:tid 39724] [client 216.73.163.154:61299] [client 216.73.163.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aSIH8kUgrb325CIAjPq6vAAAAAM"]
[Sun Nov 23 02:59:00.488987 2025] [proxy_fcgi:error] [pid 39942:tid 40013] [client 216.73.163.132:34699] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 02:59:00.852841 2025] [:error] [pid 39942:tid 40004] [client 216.73.163.132:34699] [client 216.73.163.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aSIH9KNupsOsQf9D2gyBuQAAAUk"]
[Sun Nov 23 02:59:02.428486 2025] [:error] [pid 39713:tid 39725] [client 216.73.163.146:39481] [client 216.73.163.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/db.php"] [unique_id "aSIH9kUgrb325CIAjPq6wAAAAAQ"]
[Sun Nov 23 02:59:03.170133 2025] [:error] [pid 39942:tid 40018] [client 216.73.163.155:44939] [client 216.73.163.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aSIH96NupsOsQf9D2gyBvwAAAVc"]
[Sun Nov 23 02:59:03.958225 2025] [:error] [pid 8816:tid 8907] [client 45.146.54.136:43801] [client 45.146.54.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aSIH95b4RIAN-_BXnHmO-wAAAJY"]
[Sun Nov 23 02:59:04.660110 2025] [:error] [pid 39942:tid 40011] [client 45.146.54.138:55673] [client 45.146.54.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aSIH-KNupsOsQf9D2gyBwQAAAVA"]
[Sun Nov 23 02:59:05.462944 2025] [:error] [pid 39942:tid 40000] [client 45.146.54.133:61915] [client 45.146.54.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aSIH-aNupsOsQf9D2gyBxQAAAUU"]
[Sun Nov 23 02:59:06.185767 2025] [:error] [pid 8816:tid 8906] [client 216.73.163.156:53561] [client 216.73.163.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aSIH-pb4RIAN-_BXnHmPAAAAAJU"]
[Sun Nov 23 02:59:08.592708 2025] [:error] [pid 8816:tid 8892] [client 45.146.54.137:27019] [client 45.146.54.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aSIH_Jb4RIAN-_BXnHmPCAAAAIg"]
[Sun Nov 23 02:59:09.310044 2025] [:error] [pid 39713:tid 39740] [client 216.73.163.145:53891] [client 216.73.163.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aSIH_UUgrb325CIAjPq6xwAAABM"]
[Sun Nov 23 02:59:10.076263 2025] [:error] [pid 8816:tid 8902] [client 216.73.163.148:52537] [client 216.73.163.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aSIH_pb4RIAN-_BXnHmPCgAAAJE"]
[Sun Nov 23 02:59:11.588429 2025] [:error] [pid 39719:tid 39782] [client 216.73.163.154:51535] [client 216.73.163.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aSIH_xmP4k0tY5Yex-Xo4wAAAQY"]
[Sun Nov 23 02:59:14.018218 2025] [:error] [pid 8816:tid 8892] [client 216.73.163.141:46185] [client 216.73.163.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aSIIApb4RIAN-_BXnHmPDwAAAIg"]
[Sun Nov 23 02:59:14.721323 2025] [proxy_fcgi:error] [pid 39713:tid 39742] [client 216.73.163.142:65213] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 02:59:17.432262 2025] [:error] [pid 39942:tid 40006] [client 216.73.163.144:54537] [client 216.73.163.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.144, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aSIIBaNupsOsQf9D2gyB2AAAAUs"]
[Sun Nov 23 02:59:26.033702 2025] [:error] [pid 39718:tid 39771] [client 216.73.163.160:44053] [client 216.73.163.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aSIIDgQ3B_uDoeItNmOJ1gAAAFY"]
[Sun Nov 23 02:59:26.827832 2025] [:error] [pid 39942:tid 40003] [client 216.73.163.154:40259] [client 216.73.163.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aSIIDqNupsOsQf9D2gyB5AAAAUg"]
[Sun Nov 23 02:59:42.268034 2025] [:error] [pid 39719:tid 39796] [client 216.73.163.144:20613] [client 216.73.163.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSIIHhmP4k0tY5Yex-XpGgAAARQ"]
[Sun Nov 23 02:59:43.967229 2025] [:error] [pid 39713:tid 39743] [client 216.73.163.143:46989] [client 216.73.163.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aSIIH0Ugrb325CIAjPq6-wAAABY"]
[Sun Nov 23 02:59:44.761317 2025] [:error] [pid 39942:tid 39997] [client 216.73.163.143:51945] [client 216.73.163.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aSIIIKNupsOsQf9D2gyCCgAAAUI"]
[Sun Nov 23 02:59:50.211738 2025] [:error] [pid 39942:tid 40014] [client 216.73.163.138:27553] [client 216.73.163.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aSIIJqNupsOsQf9D2gyCHQAAAVM"]
[Sun Nov 23 02:59:50.902626 2025] [:error] [pid 39719:tid 39791] [client 45.131.194.123:36609] [client 45.131.194.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aSIIJhmP4k0tY5Yex-XpJAAAAQ8"]
[Sun Nov 23 02:59:51.639189 2025] [:error] [pid 39719:tid 39788] [client 216.73.163.144:51629] [client 216.73.163.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aSIIJxmP4k0tY5Yex-XpJwAAAQw"]
[Sun Nov 23 02:59:55.479007 2025] [:error] [pid 8816:tid 8884] [client 216.73.163.151:20931] [client 216.73.163.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aSIIK5b4RIAN-_BXnHmPegAAAIA"]
[Sun Nov 23 02:59:56.922499 2025] [:error] [pid 8816:tid 8907] [client 45.131.194.123:28771] [client 45.131.194.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aSIILJb4RIAN-_BXnHmPfQAAAJY"]
[Sun Nov 23 03:00:00.550080 2025] [:error] [pid 8816:tid 8887] [client 216.73.163.117:64779] [client 216.73.163.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aSIIMJb4RIAN-_BXnHmPjwAAAIM"]
[Sun Nov 23 03:00:11.094579 2025] [:error] [pid 8816:tid 8896] [client 216.73.163.156:32325] [client 216.73.163.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aSIIO5b4RIAN-_BXnHmPmgAAAIs"]
[Sun Nov 23 03:00:13.391918 2025] [:error] [pid 39713:tid 39725] [client 216.73.163.145:56563] [client 216.73.163.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/about.php"] [unique_id "aSIIPUUgrb325CIAjPq7DQAAAAQ"]
[Sun Nov 23 03:00:18.697462 2025] [:error] [pid 8816:tid 8897] [client 216.73.163.154:34749] [client 216.73.163.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aSIIQpb4RIAN-_BXnHmPsQAAAIw"]
[Sun Nov 23 03:00:21.076358 2025] [:error] [pid 8816:tid 8890] [client 216.73.163.150:48317] [client 216.73.163.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aSIIRZb4RIAN-_BXnHmPugAAAIY"]
[Sun Nov 23 03:00:24.900083 2025] [:error] [pid 8816:tid 8884] [client 216.73.163.143:59321] [client 216.73.163.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aSIISJb4RIAN-_BXnHmPywAAAIA"]
[Sun Nov 23 03:00:29.447598 2025] [:error] [pid 8816:tid 8898] [client 216.73.163.141:32807] [client 216.73.163.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aSIITZb4RIAN-_BXnHmP4AAAAI0"]
[Sun Nov 23 03:00:31.675741 2025] [:error] [pid 39942:tid 40005] [client 216.73.163.152:62707] [client 216.73.163.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aSIIT6NupsOsQf9D2gyCZwAAAUo"]
[Sun Nov 23 03:00:32.380501 2025] [:error] [pid 39942:tid 40014] [client 216.73.163.119:20885] [client 216.73.163.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aSIIUKNupsOsQf9D2gyCaAAAAVM"]
[Sun Nov 23 03:00:37.071640 2025] [:error] [pid 39719:tid 39798] [client 216.73.163.151:53857] [client 216.73.163.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aSIIVRmP4k0tY5Yex-XpVwAAARY"]
[Sun Nov 23 03:00:41.614495 2025] [:error] [pid 39942:tid 39998] [client 216.73.163.121:22111] [client 216.73.163.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aSIIWaNupsOsQf9D2gyCeAAAAUM"]
[Sun Nov 23 03:00:45.528004 2025] [:error] [pid 8816:tid 8890] [client 216.73.163.153:26459] [client 216.73.163.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSIIXZb4RIAN-_BXnHmP_QAAAIY"]
[Sun Nov 23 03:00:46.257743 2025] [:error] [pid 39713:tid 39723] [client 216.73.163.122:42159] [client 216.73.163.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aSIIXkUgrb325CIAjPq7NwAAAAI"]
[Sun Nov 23 03:00:48.439914 2025] [:error] [pid 39942:tid 40003] [client 216.73.163.154:42427] [client 216.73.163.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aSIIYKNupsOsQf9D2gyChAAAAUg"]
[Sun Nov 23 03:00:51.417902 2025] [:error] [pid 39942:tid 40004] [client 216.73.163.131:41915] [client 216.73.163.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aSIIY6NupsOsQf9D2gyCiAAAAUk"]
[Sun Nov 23 03:00:52.176299 2025] [:error] [pid 39713:tid 39730] [client 216.73.163.141:28683] [client 216.73.163.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aSIIZEUgrb325CIAjPq7QAAAAAk"]
[Sun Nov 23 03:00:57.529408 2025] [:error] [pid 39713:tid 39741] [client 216.73.163.149:39739] [client 216.73.163.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aSIIaUUgrb325CIAjPq7RwAAABQ"]
[Sun Nov 23 03:00:59.767318 2025] [:error] [pid 8816:tid 8888] [client 216.73.163.152:59483] [client 216.73.163.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aSIIa5b4RIAN-_BXnHmQEQAAAIQ"]
[Sun Nov 23 03:01:00.505758 2025] [:error] [pid 39942:tid 40000] [client 216.73.163.149:37235] [client 216.73.163.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aSIIbKNupsOsQf9D2gyCkwAAAUU"]
[Sun Nov 23 03:01:03.056465 2025] [:error] [pid 39719:tid 39794] [client 216.73.163.142:22073] [client 216.73.163.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aSIIbxmP4k0tY5Yex-XpjgAAARI"]
[Sun Nov 23 03:01:04.603463 2025] [:error] [pid 39718:tid 39767] [client 216.73.163.132:60525] [client 216.73.163.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aSIIcAQ3B_uDoeItNmOKTgAAAFI"]
[Sun Nov 23 03:01:09.187831 2025] [:error] [pid 8816:tid 8904] [client 216.73.163.119:34189] [client 216.73.163.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aSIIdZb4RIAN-_BXnHmQJgAAAJM"]
[Sun Nov 23 03:01:11.617240 2025] [:error] [pid 39713:tid 39744] [client 45.146.54.130:46037] [client 45.146.54.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aSIId0Ugrb325CIAjPq7WQAAABc"]
[Sun Nov 23 03:01:15.128123 2025] [:error] [pid 39942:tid 40017] [client 216.73.163.145:36017] [client 216.73.163.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aSIIe6NupsOsQf9D2gyCswAAAVY"]
[Sun Nov 23 03:01:16.682624 2025] [:error] [pid 8816:tid 8886] [client 216.73.163.154:58135] [client 216.73.163.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/as.php"] [unique_id "aSIIfJb4RIAN-_BXnHmQMgAAAII"]
[Sun Nov 23 03:01:19.711121 2025] [:error] [pid 39942:tid 40015] [client 45.146.54.130:47459] [client 45.146.54.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aSIIf6NupsOsQf9D2gyCuQAAAVQ"]
[Sun Nov 23 03:01:20.392845 2025] [:error] [pid 39942:tid 40005] [client 216.73.163.154:57739] [client 216.73.163.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/install.php"] [unique_id "aSIIgKNupsOsQf9D2gyCvQAAAUo"]
[Sun Nov 23 03:01:21.103715 2025] [:error] [pid 39942:tid 40004] [client 216.73.163.138:62957] [client 216.73.163.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aSIIgaNupsOsQf9D2gyCwwAAAUk"]
[Sun Nov 23 03:01:27.536080 2025] [:error] [pid 39942:tid 40009] [client 216.73.163.145:62813] [client 216.73.163.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aSIIh6NupsOsQf9D2gyC2QAAAU4"]
[Sun Nov 23 03:01:30.752384 2025] [:error] [pid 8816:tid 8901] [client 45.146.54.130:42255] [client 45.146.54.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aSIIipb4RIAN-_BXnHmQVAAAAJA"]
[Sun Nov 23 03:01:33.965306 2025] [:error] [pid 8816:tid 8908] [client 45.146.54.137:54547] [client 45.146.54.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aSIIjZb4RIAN-_BXnHmQWgAAAJc"]
[Sun Nov 23 03:01:36.944915 2025] [:error] [pid 8816:tid 8899] [client 216.73.163.116:58033] [client 216.73.163.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aSIIkJb4RIAN-_BXnHmQaAAAAI4"]
[Sun Nov 23 03:01:42.328408 2025] [:error] [pid 39713:tid 39726] [client 216.73.163.131:25137] [client 216.73.163.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aSIIlkUgrb325CIAjPq7kQAAAAU"]
[Sun Nov 23 03:01:43.824585 2025] [:error] [pid 39718:tid 39770] [client 216.73.163.134:35099] [client 216.73.163.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aSIIlwQ3B_uDoeItNmOKfAAAAFU"]
[Sun Nov 23 03:01:45.298287 2025] [:error] [pid 39718:tid 39752] [client 216.73.163.149:36071] [client 216.73.163.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aSIImQQ3B_uDoeItNmOKfwAAAEM"]
[Sun Nov 23 03:01:47.615206 2025] [:error] [pid 8816:tid 8904] [client 216.73.163.122:42359] [client 216.73.163.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aSIIm5b4RIAN-_BXnHmQfQAAAJM"]
[Sun Nov 23 03:01:54.786631 2025] [:error] [pid 39942:tid 40003] [client 216.73.163.143:48771] [client 216.73.163.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aSIIoqNupsOsQf9D2gyDFQAAAUg"]
[Sun Nov 23 03:01:55.527202 2025] [:error] [pid 8816:tid 8910] [client 216.73.163.120:47451] [client 216.73.163.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aSIIo5b4RIAN-_BXnHmQjwAAAJg"]
[Sun Nov 23 03:01:58.716816 2025] [:error] [pid 8816:tid 8901] [client 216.73.163.143:35485] [client 216.73.163.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aSIIppb4RIAN-_BXnHmQmQAAAJA"]
[Sun Nov 23 03:01:59.416006 2025] [:error] [pid 8816:tid 8895] [client 216.73.163.138:37771] [client 216.73.163.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSIIp5b4RIAN-_BXnHmQmwAAAIo"]
[Sun Nov 23 03:02:03.054635 2025] [:error] [pid 39713:tid 39739] [client 45.131.194.122:56981] [client 45.131.194.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aSIIq0Ugrb325CIAjPq7uQAAABI"]
[Sun Nov 23 03:02:03.808835 2025] [:error] [pid 39719:tid 39783] [client 216.73.163.139:49721] [client 216.73.163.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aSIIqxmP4k0tY5Yex-Xp9gAAAQc"]
[Sun Nov 23 03:02:04.592690 2025] [:error] [pid 39942:tid 40017] [client 45.146.54.131:41533] [client 45.146.54.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.146.54.131, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aSIIrKNupsOsQf9D2gyDLQAAAVY"]
[Sun Nov 23 03:02:04.597528 2025] [proxy_fcgi:error] [pid 39942:tid 40017] [client 45.146.54.131:41533] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 03:02:04.945582 2025] [:error] [pid 39942:tid 40014] [client 45.146.54.131:41533] [client 45.146.54.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aSIIrKNupsOsQf9D2gyDLgAAAVM"]
[Sun Nov 23 03:02:07.969016 2025] [:error] [pid 8816:tid 8894] [client 216.73.163.121:28443] [client 216.73.163.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSIIr5b4RIAN-_BXnHmQtwAAAIk"]
[Sun Nov 23 03:02:08.774306 2025] [:error] [pid 39718:tid 39768] [client 216.73.163.120:58397] [client 216.73.163.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/network.php"] [unique_id "aSIIsAQ3B_uDoeItNmOKnAAAAFM"]
[Sun Nov 23 03:02:15.036283 2025] [:error] [pid 8816:tid 8886] [client 45.131.194.123:54171] [client 45.131.194.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aSIIt5b4RIAN-_BXnHmQxgAAAII"]
[Sun Nov 23 03:02:15.806601 2025] [:error] [pid 39713:tid 39735] [client 216.73.163.123:52135] [client 216.73.163.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aSIIt0Ugrb325CIAjPq75gAAAA4"]
[Sun Nov 23 03:02:18.216808 2025] [:error] [pid 39719:tid 39800] [client 45.146.54.138:56371] [client 45.146.54.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aSIIuhmP4k0tY5Yex-XqGgAAARg"]
[Sun Nov 23 03:02:18.920600 2025] [:error] [pid 8816:tid 8906] [client 216.73.163.152:20417] [client 216.73.163.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aSIIupb4RIAN-_BXnHmQ0gAAAJU"]
[Sun Nov 23 03:02:19.657301 2025] [proxy_fcgi:error] [pid 39718:tid 39753] [client 216.73.163.130:32117] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 03:02:20.073881 2025] [:error] [pid 39718:tid 39772] [client 216.73.163.130:32117] [client 216.73.163.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.130, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSIIvAQ3B_uDoeItNmOKzAAAAFc"]
[Sun Nov 23 03:02:21.631953 2025] [:error] [pid 39942:tid 39997] [client 216.73.163.147:22167] [client 216.73.163.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aSIIvaNupsOsQf9D2gyDnAAAAUI"]
[Sun Nov 23 03:02:25.482487 2025] [:error] [pid 39713:tid 39732] [client 216.73.163.123:28685] [client 216.73.163.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aSIIwUUgrb325CIAjPq8BAAAAAs"]
[Sun Nov 23 03:02:26.960468 2025] [:error] [pid 39718:tid 39772] [client 216.73.163.129:49935] [client 216.73.163.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aSIIwgQ3B_uDoeItNmOK1wAAAFc"]
[Sun Nov 23 03:02:27.668644 2025] [:error] [pid 39713:tid 39725] [client 216.73.163.129:23655] [client 216.73.163.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aSIIw0Ugrb325CIAjPq8BgAAAAQ"]
[Sun Nov 23 03:02:31.109610 2025] [:error] [pid 8816:tid 8903] [client 45.146.54.131:54465] [client 45.146.54.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aSIIx5b4RIAN-_BXnHmQ6gAAAJI"]
[Sun Nov 23 03:02:33.330661 2025] [:error] [pid 39713:tid 39727] [client 216.73.163.135:61857] [client 216.73.163.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aSIIyUUgrb325CIAjPq8EAAAAAY"]
[Sun Nov 23 03:02:37.036230 2025] [:error] [pid 39713:tid 39728] [client 216.73.163.131:41731] [client 216.73.163.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aSIIzUUgrb325CIAjPq8FgAAAAc"]
[Sun Nov 23 03:02:37.831389 2025] [:error] [pid 39719:tid 39783] [client 216.73.163.145:31437] [client 216.73.163.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "aSIIzRmP4k0tY5Yex-XqbAAAAQc"]
[Sun Nov 23 03:02:39.342143 2025] [:error] [pid 39942:tid 40003] [client 216.73.163.116:45589] [client 216.73.163.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/count.php"] [unique_id "aSIIz6NupsOsQf9D2gyD0AAAAUg"]
[Sun Nov 23 03:02:44.594616 2025] [:error] [pid 8816:tid 8905] [client 216.73.163.132:61853] [client 216.73.163.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSII1Jb4RIAN-_BXnHmREQAAAJQ"]
[Sun Nov 23 03:02:46.863799 2025] [:error] [pid 39942:tid 40003] [client 45.146.54.131:50051] [client 45.146.54.131] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "perthactive.com.au"] [uri "/images/stories/themes.php"] [unique_id "aSII1qNupsOsQf9D2gyD3QAAAUg"]
[Sun Nov 23 03:02:47.850176 2025] [:error] [pid 39942:tid 40013] [client 45.146.54.131:50051] [client 45.146.54.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aSII16NupsOsQf9D2gyD3gAAAVI"]
[Sun Nov 23 03:02:50.136394 2025] [:error] [pid 39942:tid 40006] [client 216.73.163.121:34857] [client 216.73.163.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aSII2qNupsOsQf9D2gyD5gAAAUs"]
[Sun Nov 23 03:02:50.843297 2025] [:error] [pid 39718:tid 39765] [client 45.146.54.135:23449] [client 45.146.54.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aSII2gQ3B_uDoeItNmOLDQAAAFA"]
[Sun Nov 23 03:02:56.272693 2025] [:error] [pid 39713:tid 39727] [client 216.73.163.157:56807] [client 216.73.163.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aSII4EUgrb325CIAjPq8JgAAAAY"]
[Sun Nov 23 03:02:58.621901 2025] [:error] [pid 8816:tid 8884] [client 216.73.163.149:22453] [client 216.73.163.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aSII4pb4RIAN-_BXnHmRLQAAAIA"]
[Sun Nov 23 03:03:00.220935 2025] [:error] [pid 39718:tid 39758] [client 216.73.163.145:47455] [client 216.73.163.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aSII5AQ3B_uDoeItNmOLIAAAAEk"]
[Sun Nov 23 03:03:04.690093 2025] [:error] [pid 39713:tid 39721] [client 216.73.163.116:41011] [client 216.73.163.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aSII6EUgrb325CIAjPq8PAAAAAA"]
[Sun Nov 23 03:03:06.122101 2025] [:error] [pid 8816:tid 8899] [client 45.146.54.137:52561] [client 45.146.54.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/colour.php"] [unique_id "aSII6pb4RIAN-_BXnHmRUwAAAI4"]
[Sun Nov 23 03:03:07.632898 2025] [:error] [pid 39719:tid 39795] [client 216.73.163.142:57241] [client 216.73.163.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aSII6xmP4k0tY5Yex-XqmAAAARM"]
[Sun Nov 23 03:03:08.324171 2025] [:error] [pid 39713:tid 39723] [client 216.73.163.121:57671] [client 216.73.163.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aSII7EUgrb325CIAjPq8TQAAAAI"]
[Sun Nov 23 03:03:10.638509 2025] [:error] [pid 39719:tid 39783] [client 216.73.163.119:40313] [client 216.73.163.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aSII7hmP4k0tY5Yex-XqoQAAAQc"]
[Sun Nov 23 03:03:14.557698 2025] [:error] [pid 8816:tid 8897] [client 216.73.163.120:33847] [client 216.73.163.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aSII8pb4RIAN-_BXnHmRZAAAAIw"]
[Sun Nov 23 03:03:15.275144 2025] [:error] [pid 8816:tid 8890] [client 216.73.163.136:57315] [client 216.73.163.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aSII85b4RIAN-_BXnHmRZgAAAIY"]
[Sun Nov 23 03:03:19.773803 2025] [:error] [pid 39718:tid 39762] [client 216.73.163.119:55153] [client 216.73.163.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aSII9wQ3B_uDoeItNmOLOAAAAE0"]
[Sun Nov 23 03:03:22.028198 2025] [:error] [pid 39719:tid 39779] [client 45.146.54.139:33719] [client 45.146.54.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aSII-hmP4k0tY5Yex-XqwQAAAQM"]
[Sun Nov 23 03:03:25.088826 2025] [:error] [pid 39713:tid 39736] [client 216.73.163.156:62995] [client 216.73.163.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aSII_UUgrb325CIAjPq8hwAAAA8"]
[Sun Nov 23 03:03:25.775504 2025] [:error] [pid 39942:tid 40013] [client 216.73.163.146:39293] [client 216.73.163.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aSII_aNupsOsQf9D2gyENQAAAVI"]
[Sun Nov 23 03:03:27.278860 2025] [:error] [pid 39942:tid 40009] [client 216.73.163.149:41317] [client 216.73.163.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aSII_6NupsOsQf9D2gyENwAAAU4"]
[Sun Nov 23 03:03:29.526824 2025] [:error] [pid 39718:tid 39755] [client 216.73.163.156:20667] [client 216.73.163.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aSIJAQQ3B_uDoeItNmOLSAAAAEY"]
[Sun Nov 23 03:03:31.706467 2025] [:error] [pid 39718:tid 39750] [client 216.73.163.146:49957] [client 216.73.163.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aSIJAwQ3B_uDoeItNmOLTAAAAEE"]
[Sun Nov 23 03:03:32.441993 2025] [:error] [pid 39713:tid 39744] [client 216.73.163.152:56821] [client 216.73.163.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aSIJBEUgrb325CIAjPq8mQAAABc"]
[Sun Nov 23 03:03:35.301150 2025] [:error] [pid 8816:tid 8899] [client 216.73.163.116:52155] [client 216.73.163.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSIJB5b4RIAN-_BXnHmRjQAAAI4"]
[Sun Nov 23 03:03:35.990335 2025] [:error] [pid 39713:tid 39741] [client 45.146.54.131:53075] [client 45.146.54.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aSIJB0Ugrb325CIAjPq8nQAAABQ"]
[Sun Nov 23 03:03:38.319205 2025] [:error] [pid 39942:tid 40016] [client 216.73.163.154:56631] [client 216.73.163.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSIJCqNupsOsQf9D2gyERAAAAVU"]
[Sun Nov 23 03:03:39.807676 2025] [:error] [pid 39719:tid 39794] [client 216.73.163.154:37133] [client 216.73.163.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aSIJCxmP4k0tY5Yex-Xq2wAAARI"]
[Sun Nov 23 03:03:40.525797 2025] [:error] [pid 8816:tid 8886] [client 45.146.54.130:38795] [client 45.146.54.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSIJDJb4RIAN-_BXnHmRngAAAII"]
[Sun Nov 23 03:03:41.281055 2025] [:error] [pid 39719:tid 39790] [client 216.73.163.133:37625] [client 216.73.163.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aSIJDRmP4k0tY5Yex-Xq3AAAAQ4"]
[Sun Nov 23 03:03:44.181043 2025] [:error] [pid 39719:tid 39796] [client 45.146.54.139:37919] [client 45.146.54.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aSIJEBmP4k0tY5Yex-Xq5AAAARQ"]
[Sun Nov 23 03:03:46.440156 2025] [:error] [pid 39942:tid 39998] [client 216.73.163.159:22139] [client 216.73.163.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aSIJEqNupsOsQf9D2gyETgAAAUM"]
[Sun Nov 23 03:03:47.941174 2025] [:error] [pid 39713:tid 39724] [client 216.73.163.160:62161] [client 216.73.163.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aSIJE0Ugrb325CIAjPq8qwAAAAM"]
[Sun Nov 23 03:03:48.650302 2025] [proxy_fcgi:error] [pid 39718:tid 39770] [client 216.73.163.138:33301] AH01071: Got error 'PHP message: PHP Fatal error: Uncaught Error: Call to undefined function get_locale() in /home/perthactivecom/public_html/wp-admin/includes/admin.php:16\nStack trace:\n#0 {main}\n thrown in /home/perthactivecom/public_html/wp-admin/includes/admin.php on line 16'
[Sun Nov 23 03:03:49.401338 2025] [:error] [pid 39718:tid 39755] [client 216.73.163.140:24905] [client 216.73.163.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aSIJFQQ3B_uDoeItNmOLbQAAAEY"]
[Sun Nov 23 03:03:54.803278 2025] [:error] [pid 8816:tid 8894] [client 45.146.54.130:63777] [client 45.146.54.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aSIJGpb4RIAN-_BXnHmR_QAAAIk"]
[Sun Nov 23 03:03:55.536156 2025] [:error] [pid 39713:tid 39725] [client 216.73.163.136:45005] [client 216.73.163.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aSIJG0Ugrb325CIAjPq8twAAAAQ"]
[Sun Nov 23 03:03:58.866270 2025] [:error] [pid 39718:tid 39762] [client 45.146.54.131:28703] [client 45.146.54.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aSIJHgQ3B_uDoeItNmOLvAAAAE0"]
[Sun Nov 23 03:04:02.760537 2025] [:error] [pid 39942:tid 40006] [client 216.73.163.121:54281] [client 216.73.163.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aSIJIqNupsOsQf9D2gyEYwAAAUs"]
[Sun Nov 23 03:04:04.971861 2025] [:error] [pid 39718:tid 39755] [client 216.73.163.149:27845] [client 216.73.163.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aSIJJAQ3B_uDoeItNmOLxQAAAEY"]
[Sun Nov 23 03:04:08.239873 2025] [:error] [pid 8816:tid 8900] [client 216.73.163.148:29547] [client 216.73.163.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aSIJKJb4RIAN-_BXnHmSGQAAAI8"]
[Sun Nov 23 03:04:10.807110 2025] [:error] [pid 39942:tid 40017] [client 216.73.163.151:36271] [client 216.73.163.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aSIJKqNupsOsQf9D2gyEdwAAAVY"]
[Sun Nov 23 03:04:12.316124 2025] [:error] [pid 8816:tid 8889] [client 216.73.163.153:25591] [client 216.73.163.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aSIJLJb4RIAN-_BXnHmSIgAAAIU"]
[Sun Nov 23 03:04:16.058847 2025] [:error] [pid 39719:tid 39779] [client 216.73.163.156:21651] [client 216.73.163.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSIJMBmP4k0tY5Yex-XrSwAAAQM"]
[Sun Nov 23 03:04:19.049212 2025] [:error] [pid 39713:tid 39745] [client 216.73.163.158:20941] [client 216.73.163.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aSIJM0Ugrb325CIAjPq8xgAAABg"]
[Sun Nov 23 03:04:19.794490 2025] [proxy_fcgi:error] [pid 39713:tid 39743] [client 45.146.54.130:59345] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 03:04:20.135671 2025] [:error] [pid 39713:tid 39741] [client 45.146.54.130:59345] [client 45.146.54.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aSIJNEUgrb325CIAjPq8yAAAABQ"]
[Sun Nov 23 03:04:20.937924 2025] [:error] [pid 39718:tid 39773] [client 45.131.194.123:50953] [client 45.131.194.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aSIJNAQ3B_uDoeItNmOL0wAAAFg"]
[Sun Nov 23 03:04:23.207188 2025] [:error] [pid 8816:tid 8888] [client 216.73.163.160:64465] [client 216.73.163.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aSIJN5b4RIAN-_BXnHmSPAAAAIQ"]
[Sun Nov 23 03:04:23.953724 2025] [:error] [pid 39718:tid 39751] [client 216.73.163.148:24887] [client 216.73.163.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aSIJNwQ3B_uDoeItNmOL1wAAAEI"]
[Sun Nov 23 03:04:29.210160 2025] [:error] [pid 39719:tid 39786] [client 45.131.194.123:54381] [client 45.131.194.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aSIJPRmP4k0tY5Yex-XrgAAAAQo"]
[Sun Nov 23 03:04:29.984759 2025] [:error] [pid 8816:tid 8885] [client 216.73.163.153:54723] [client 216.73.163.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aSIJPZb4RIAN-_BXnHmSSAAAAIE"]
[Sun Nov 23 03:04:31.482042 2025] [:error] [pid 8816:tid 8888] [client 216.73.163.140:65251] [client 216.73.163.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/log.php"] [unique_id "aSIJP5b4RIAN-_BXnHmSSQAAAIQ"]
[Sun Nov 23 03:04:32.184516 2025] [:error] [pid 39718:tid 39761] [client 45.146.54.139:21073] [client 45.146.54.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aSIJQAQ3B_uDoeItNmOL5wAAAEw"]
[Sun Nov 23 03:04:32.916220 2025] [:error] [pid 39942:tid 40004] [client 216.73.163.120:57273] [client 216.73.163.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aSIJQKNupsOsQf9D2gyEjAAAAUk"]
[Sun Nov 23 03:04:33.608779 2025] [:error] [pid 39713:tid 39741] [client 216.73.163.149:48239] [client 216.73.163.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/aw.php"] [unique_id "aSIJQUUgrb325CIAjPq81AAAABQ"]
[Sun Nov 23 03:04:37.473707 2025] [:error] [pid 39942:tid 40001] [client 216.73.163.117:52017] [client 216.73.163.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aSIJRaNupsOsQf9D2gyElQAAAUY"]
[Sun Nov 23 03:04:38.171819 2025] [:error] [pid 39719:tid 39784] [client 45.146.54.138:36819] [client 45.146.54.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "aSIJRhmP4k0tY5Yex-XrmwAAAQg"]
[Sun Nov 23 03:04:40.386255 2025] [:error] [pid 39718:tid 39750] [client 45.146.54.137:58911] [client 45.146.54.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aSIJSAQ3B_uDoeItNmOL7wAAAEE"]
[Sun Nov 23 03:04:41.145386 2025] [:error] [pid 8816:tid 8904] [client 45.131.194.123:36417] [client 45.131.194.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aSIJSZb4RIAN-_BXnHmSUwAAAJM"]
[Sun Nov 23 03:04:43.404880 2025] [:error] [pid 39942:tid 39998] [client 216.73.163.148:62679] [client 216.73.163.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "aSIJS6NupsOsQf9D2gyEsQAAAUM"]
[Sun Nov 23 03:04:44.134981 2025] [:error] [pid 39713:tid 39737] [client 216.73.163.131:36753] [client 216.73.163.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aSIJTEUgrb325CIAjPq82gAAABA"]
[Sun Nov 23 03:04:50.324010 2025] [:error] [pid 39719:tid 39783] [client 216.73.163.117:37695] [client 216.73.163.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aSIJUhmP4k0tY5Yex-XrrQAAAQc"]
[Sun Nov 23 03:04:51.025847 2025] [:error] [pid 39713:tid 39725] [client 216.73.163.150:61993] [client 216.73.163.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aSIJU0Ugrb325CIAjPq84wAAAAQ"]
[Sun Nov 23 03:04:53.326020 2025] [:error] [pid 39942:tid 40013] [client 216.73.163.120:44219] [client 216.73.163.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/file.php"] [unique_id "aSIJVaNupsOsQf9D2gyE2AAAAVI"]
[Sun Nov 23 03:04:54.787385 2025] [:error] [pid 39713:tid 39728] [client 216.73.163.136:32907] [client 216.73.163.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aSIJVkUgrb325CIAjPq85gAAAAc"]
[Sun Nov 23 03:04:56.356422 2025] [:error] [pid 39719:tid 39799] [client 216.73.163.116:41997] [client 216.73.163.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/load.php"] [unique_id "aSIJWBmP4k0tY5Yex-XrsgAAARc"]
[Sun Nov 23 03:04:57.043929 2025] [:error] [pid 39942:tid 40015] [client 216.73.163.146:26365] [client 216.73.163.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aSIJWaNupsOsQf9D2gyE7gAAAVQ"]
[Sun Nov 23 03:04:57.773027 2025] [:error] [pid 39713:tid 39742] [client 45.146.54.131:58965] [client 45.146.54.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aSIJWUUgrb325CIAjPq87AAAABU"]
[Sun Nov 23 03:05:00.802594 2025] [:error] [pid 8816:tid 8885] [client 45.131.194.123:51651] [client 45.131.194.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aSIJXJb4RIAN-_BXnHmSdQAAAIE"]
[Sun Nov 23 03:05:02.311987 2025] [:error] [pid 8816:tid 8896] [client 216.73.163.150:55601] [client 216.73.163.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSIJXpb4RIAN-_BXnHmSeQAAAIs"]
[Sun Nov 23 03:05:05.469770 2025] [:error] [pid 39942:tid 40003] [client 45.146.54.136:24255] [client 45.146.54.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aSIJYaNupsOsQf9D2gyFFAAAAUg"]
[Sun Nov 23 03:05:06.213035 2025] [:error] [pid 8816:tid 8908] [client 216.73.163.132:58689] [client 216.73.163.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aSIJYpb4RIAN-_BXnHmSfgAAAJc"]
[Sun Nov 23 03:05:07.753732 2025] [:error] [pid 39718:tid 39768] [client 216.73.163.129:61435] [client 216.73.163.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aSIJYwQ3B_uDoeItNmOMDAAAAFM"]
[Sun Nov 23 03:05:15.404493 2025] [:error] [pid 39718:tid 39772] [client 216.73.163.155:47767] [client 216.73.163.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aSIJawQ3B_uDoeItNmOMEwAAAFc"]
[Sun Nov 23 03:05:16.903088 2025] [:error] [pid 39719:tid 39793] [client 45.146.54.132:43621] [client 45.146.54.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aSIJbBmP4k0tY5Yex-Xr1QAAARE"]
[Sun Nov 23 03:05:19.121364 2025] [:error] [pid 39942:tid 40014] [client 216.73.163.132:61471] [client 216.73.163.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aSIJb6NupsOsQf9D2gyFMwAAAVM"]
[Sun Nov 23 03:05:19.824207 2025] [:error] [pid 39718:tid 39768] [client 45.146.54.138:25625] [client 45.146.54.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aSIJbwQ3B_uDoeItNmOMGQAAAFM"]
[Sun Nov 23 03:05:20.508212 2025] [:error] [pid 39718:tid 39762] [client 45.146.54.137:34725] [client 45.146.54.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aSIJcAQ3B_uDoeItNmOMHQAAAE0"]
[Sun Nov 23 03:05:21.965246 2025] [autoindex:error] [pid 39718:tid 39763] [client 216.73.163.146:27255] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:22.324631 2025] [autoindex:error] [pid 39718:tid 39769] [client 216.73.163.146:27255] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:22.673432 2025] [autoindex:error] [pid 39718:tid 39757] [client 216.73.163.146:27255] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:23.076908 2025] [autoindex:error] [pid 39718:tid 39754] [client 216.73.163.146:27255] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:25.681588 2025] [autoindex:error] [pid 8816:tid 8900] [client 216.73.163.143:44535] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:26.048474 2025] [autoindex:error] [pid 8816:tid 8904] [client 216.73.163.143:44535] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:26.433569 2025] [autoindex:error] [pid 8816:tid 8888] [client 216.73.163.143:44535] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:27.898679 2025] [autoindex:error] [pid 8816:tid 8896] [client 216.73.163.138:59119] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:29.103110 2025] [autoindex:error] [pid 39713:tid 39737] [client 216.73.163.131:50063] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:29.452856 2025] [autoindex:error] [pid 39713:tid 39721] [client 216.73.163.131:50063] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:31.351886 2025] [autoindex:error] [pid 39718:tid 39768] [client 216.73.163.118:25775] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:31.697381 2025] [autoindex:error] [pid 39718:tid 39759] [client 216.73.163.118:25775] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:32.058262 2025] [autoindex:error] [pid 39718:tid 39758] [client 216.73.163.118:25775] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:32.403011 2025] [autoindex:error] [pid 39718:tid 39770] [client 216.73.163.118:25775] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:35.838498 2025] [autoindex:error] [pid 39718:tid 39751] [client 216.73.163.139:28127] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:39.008750 2025] [autoindex:error] [pid 8816:tid 8892] [client 216.73.163.149:22435] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:39.357369 2025] [autoindex:error] [pid 8816:tid 8885] [client 216.73.163.149:22435] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:39.815520 2025] [autoindex:error] [pid 8816:tid 8884] [client 216.73.163.149:22435] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:42.487144 2025] [autoindex:error] [pid 39718:tid 39752] [client 45.146.54.134:41147] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:45.107082 2025] [autoindex:error] [pid 8816:tid 8894] [client 216.73.163.116:47455] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:46.256428 2025] [autoindex:error] [pid 39719:tid 39778] [client 216.73.163.131:39505] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:46.621950 2025] [autoindex:error] [pid 39719:tid 39777] [client 216.73.163.131:39505] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:47.400686 2025] [proxy_fcgi:error] [pid 39719:tid 39789] [client 216.73.163.131:39505] AH01071: Got error 'PHP message: PHP Warning: Use of undefined constant ABSPATH - assumed 'ABSPATH' (this will throw an Error in a future version of PHP) in /home/perthactivecom/public_html/wp-includes/blocks/index.php on line 8PHP message: PHP Warning: Use of undefined constant WPINC - assumed 'WPINC' (this will throw an Error in a future version of PHP) in /home/perthactivecom/public_html/wp-includes/blocks/index.php on line 8PHP message: PHP Warning: require(ABSPATHWPINC/blocks/legacy-widget.php): failed to open stream: No such file or directory in /home/perthactivecom/public_html/wp-includes/blocks/index.php on line 11PHP message: PHP Warning: require(ABSPATHWPINC/blocks/legacy-widget.php): failed to open stream: No such file or directory in /home/perthactivecom/public_html/wp-includes/blocks/index.php on line 11PHP message: PHP Fatal error: require(): Failed opening required 'ABSPATHWPINC/blocks/legacy-widget.php' (include_path='.:') in /home/perthactivecom/public_html/wp-includes/blocks/index.php on line 11'
[Sun Nov 23 03:05:48.106699 2025] [autoindex:error] [pid 39713:tid 39733] [client 216.73.163.146:48851] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:48.529445 2025] [autoindex:error] [pid 39713:tid 39741] [client 216.73.163.146:48851] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:48.899751 2025] [autoindex:error] [pid 39713:tid 39723] [client 216.73.163.146:48851] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:49.253457 2025] [autoindex:error] [pid 39713:tid 39721] [client 216.73.163.146:48851] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/meta/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:51.077147 2025] [autoindex:error] [pid 8816:tid 8901] [client 216.73.163.132:46013] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:51.433893 2025] [autoindex:error] [pid 8816:tid 8900] [client 216.73.163.132:46013] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:05:51.780149 2025] [autoindex:error] [pid 8816:tid 8894] [client 216.73.163.132:46013] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:11.039213 2025] [autoindex:error] [pid 39719:tid 39790] [client 216.73.163.141:52363] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:11.393451 2025] [autoindex:error] [pid 39719:tid 39794] [client 216.73.163.141:52363] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:11.847431 2025] [autoindex:error] [pid 39719:tid 39779] [client 216.73.163.141:52363] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:12.224406 2025] [autoindex:error] [pid 39719:tid 39787] [client 216.73.163.141:52363] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:12.582078 2025] [autoindex:error] [pid 39719:tid 39799] [client 216.73.163.141:52363] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/languages/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:12.941632 2025] [autoindex:error] [pid 39719:tid 39791] [client 216.73.163.141:52363] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/2022/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:14.305503 2025] [autoindex:error] [pid 39719:tid 39800] [client 216.73.163.141:52363] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:16.315252 2025] [autoindex:error] [pid 39718:tid 39749] [client 216.73.163.147:46525] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:17.398879 2025] [autoindex:error] [pid 39942:tid 40016] [client 216.73.163.159:28217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:17.755911 2025] [autoindex:error] [pid 39942:tid 40014] [client 216.73.163.159:28217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:18.107741 2025] [autoindex:error] [pid 39942:tid 40018] [client 216.73.163.159:28217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:18.948273 2025] [autoindex:error] [pid 39942:tid 40003] [client 216.73.163.159:28217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/wlw/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:19.314309 2025] [autoindex:error] [pid 39942:tid 40017] [client 216.73.163.159:28217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:19.685833 2025] [autoindex:error] [pid 39942:tid 40002] [client 216.73.163.159:28217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:20.111392 2025] [autoindex:error] [pid 39942:tid 40009] [client 216.73.163.159:28217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:20.484107 2025] [autoindex:error] [pid 39942:tid 40004] [client 216.73.163.159:28217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:37.176964 2025] [autoindex:error] [pid 39942:tid 39998] [client 216.73.163.153:28763] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/revslider/templates/immersion-photography/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:38.306360 2025] [autoindex:error] [pid 39713:tid 39721] [client 216.73.163.148:61639] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:47.159654 2025] [autoindex:error] [pid 39719:tid 39799] [client 216.73.163.148:24301] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:50.583333 2025] [autoindex:error] [pid 39718:tid 39761] [client 216.73.163.148:20227] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:51.026044 2025] [autoindex:error] [pid 39718:tid 39765] [client 216.73.163.148:20227] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:51.391335 2025] [autoindex:error] [pid 39718:tid 39750] [client 216.73.163.148:20227] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/XML/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:54.012036 2025] [autoindex:error] [pid 39719:tid 39777] [client 216.73.163.132:42379] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:54.366972 2025] [autoindex:error] [pid 39719:tid 39786] [client 216.73.163.132:42379] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:54.737558 2025] [autoindex:error] [pid 39719:tid 39781] [client 216.73.163.132:42379] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:55.113587 2025] [autoindex:error] [pid 39719:tid 39783] [client 216.73.163.132:42379] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:55.463423 2025] [autoindex:error] [pid 39719:tid 39798] [client 216.73.163.132:42379] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:55.859012 2025] [autoindex:error] [pid 39719:tid 39777] [client 216.73.163.132:42379] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:56.207170 2025] [autoindex:error] [pid 39719:tid 39797] [client 216.73.163.132:42379] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:56.564812 2025] [autoindex:error] [pid 39719:tid 39799] [client 216.73.163.132:42379] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:06:56.912675 2025] [autoindex:error] [pid 39719:tid 39781] [client 216.73.163.132:42379] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:07:13.635772 2025] [autoindex:error] [pid 39718:tid 39773] [client 216.73.163.159:60591] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 03:07:15.485852 2025] [autoindex:error] [pid 39942:tid 40016] [client 216.73.163.156:42355] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/maintenance/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 04:01:09.802947 2025] [:error] [pid 56178:tid 56215] [client 103.163.161.30:62829] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/style.php"] [unique_id "aSIWhZzQAXWPTUeTK1RgcAAAAEE"]
[Sun Nov 23 04:01:10.098474 2025] [:error] [pid 56181:tid 56258] [client 103.163.161.30:62913] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/style.php"] [unique_id "aSIWhskLwhNGnt-ns6aTiAAAAJE"]
[Sun Nov 23 04:01:10.360493 2025] [:error] [pid 56176:tid 56189] [client 103.163.161.30:62971] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/style.php"] [unique_id "aSIWhrjUOh400lKsKrFWPAAAAAI"]
[Sun Nov 23 04:01:10.606263 2025] [:error] [pid 56176:tid 56200] [client 103.163.161.30:63008] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/style.php"] [unique_id "aSIWhrjUOh400lKsKrFWRAAAAA0"]
[Sun Nov 23 04:01:10.906385 2025] [:error] [pid 56275:tid 56280] [client 103.163.161.30:63252] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style.php"] [unique_id "aSIWhrhaClcAPg7VXOSFNgAAAME"]
[Sun Nov 23 04:01:11.200829 2025] [:error] [pid 56176:tid 56201] [client 103.163.161.30:63367] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/chosen.php"] [unique_id "aSIWh7jUOh400lKsKrFWTgAAAA4"]
[Sun Nov 23 04:01:11.451312 2025] [:error] [pid 56275:tid 56282] [client 103.163.161.30:63473] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "aSIWh7haClcAPg7VXOSFPgAAAMM"]
[Sun Nov 23 04:01:11.722698 2025] [:error] [pid 56181:tid 56263] [client 103.163.161.30:63625] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/flower.php"] [unique_id "aSIWh8kLwhNGnt-ns6aTmQAAAJY"]
[Sun Nov 23 04:01:12.008416 2025] [:error] [pid 56178:tid 56234] [client 103.163.161.30:63695] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/gifclass.php"] [unique_id "aSIWiJzQAXWPTUeTK1RgsAAAAFQ"]
[Sun Nov 23 04:01:12.294735 2025] [:error] [pid 56275:tid 56288] [client 103.163.161.30:63763] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bless.php"] [unique_id "aSIWiLhaClcAPg7VXOSFWgAAAMk"]
[Sun Nov 23 04:01:12.546721 2025] [:error] [pid 56178:tid 56238] [client 103.163.161.30:63936] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/class-t.api.php"] [unique_id "aSIWiJzQAXWPTUeTK1RguAAAAFg"]
[Sun Nov 23 04:01:12.819176 2025] [:error] [pid 56176:tid 56192] [client 103.163.161.30:63979] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/blurbs.php"] [unique_id "aSIWiLjUOh400lKsKrFWYAAAAAU"]
[Sun Nov 23 04:01:13.087275 2025] [:error] [pid 56178:tid 56226] [client 103.163.161.30:64103] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/akcc.php"] [unique_id "aSIWiZzQAXWPTUeTK1RgzAAAAEw"]
[Sun Nov 23 04:01:13.346388 2025] [:error] [pid 56178:tid 56227] [client 103.163.161.30:64177] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/abcd.php"] [unique_id "aSIWiZzQAXWPTUeTK1Rg1AAAAE0"]
[Sun Nov 23 04:01:13.600245 2025] [:error] [pid 56176:tid 56206] [client 103.163.161.30:64400] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/shelp.php"] [unique_id "aSIWibjUOh400lKsKrFWdgAAABM"]
[Sun Nov 23 04:01:13.856362 2025] [:error] [pid 56178:tid 56236] [client 103.163.161.30:64492] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cord.php"] [unique_id "aSIWiZzQAXWPTUeTK1Rg4AAAAFY"]
[Sun Nov 23 04:01:14.107837 2025] [:error] [pid 56181:tid 56241] [client 103.163.161.30:64622] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/dex.php"] [unique_id "aSIWiskLwhNGnt-ns6aTxAAAAIA"]
[Sun Nov 23 04:01:14.361842 2025] [:error] [pid 56181:tid 56246] [client 103.163.161.30:64815] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aSIWiskLwhNGnt-ns6aTzAAAAIU"]
[Sun Nov 23 04:01:14.617121 2025] [:error] [pid 56176:tid 56193] [client 103.163.161.30:64926] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/file2.php"] [unique_id "aSIWirjUOh400lKsKrFWhwAAAAY"]
[Sun Nov 23 04:01:14.901473 2025] [:error] [pid 56275:tid 56291] [client 103.163.161.30:65140] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/zwso.php"] [unique_id "aSIWirhaClcAPg7VXOSFiAAAAMw"]
[Sun Nov 23 04:01:15.196995 2025] [:error] [pid 56181:tid 56249] [client 103.163.161.30:65203] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/zwso.php"] [unique_id "aSIWi8kLwhNGnt-ns6aT3wAAAIg"]
[Sun Nov 23 04:01:15.546241 2025] [:error] [pid 56178:tid 56220] [client 103.163.161.30:65511] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "aSIWi5zQAXWPTUeTK1RhDwAAAEY"]
[Sun Nov 23 04:01:15.808796 2025] [:error] [pid 56178:tid 56235] [client 103.163.161.30:49312] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bolt.php"] [unique_id "aSIWi5zQAXWPTUeTK1RhFAAAAFU"]
[Sun Nov 23 04:01:16.083527 2025] [:error] [pid 56275:tid 56285] [client 103.163.161.30:49440] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/shlo.php"] [unique_id "aSIWjLhaClcAPg7VXOSFkwAAAMY"]
[Sun Nov 23 04:01:16.353747 2025] [:error] [pid 56181:tid 56241] [client 103.163.161.30:49561] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/133.php"] [unique_id "aSIWjMkLwhNGnt-ns6aT_wAAAIA"]
[Sun Nov 23 04:01:16.611316 2025] [:error] [pid 56176:tid 56190] [client 103.163.161.30:49660] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ahax.php"] [unique_id "aSIWjLjUOh400lKsKrFWsAAAAAM"]
[Sun Nov 23 04:01:16.909789 2025] [:error] [pid 56178:tid 56214] [client 103.163.161.30:49845] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/php8.php"] [unique_id "aSIWjJzQAXWPTUeTK1RhJQAAAEA"]
[Sun Nov 23 04:01:17.203927 2025] [:error] [pid 56178:tid 56228] [client 103.163.161.30:49973] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/lufix1.php"] [unique_id "aSIWjZzQAXWPTUeTK1RhLgAAAE4"]
[Sun Nov 23 04:01:17.480029 2025] [:error] [pid 56178:tid 56221] [client 103.163.161.30:50116] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/witmm.php"] [unique_id "aSIWjZzQAXWPTUeTK1RhMgAAAEc"]
[Sun Nov 23 04:01:17.735402 2025] [:error] [pid 56181:tid 56261] [client 103.163.161.30:50263] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "aSIWjckLwhNGnt-ns6aUPwAAAJQ"]
[Sun Nov 23 04:01:17.986743 2025] [:error] [pid 56176:tid 56208] [client 103.163.161.30:50506] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aSIWjbjUOh400lKsKrFWxAAAABU"]
[Sun Nov 23 04:01:18.278965 2025] [:error] [pid 56178:tid 56228] [client 103.163.161.30:50607] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/index.php"] [unique_id "aSIWjpzQAXWPTUeTK1RhOAAAAE4"]
[Sun Nov 23 04:01:18.549083 2025] [:error] [pid 56176:tid 56188] [client 103.163.161.30:50798] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "aSIWjrjUOh400lKsKrFWzAAAAAE"]
[Sun Nov 23 04:01:18.824694 2025] [:error] [pid 56181:tid 56245] [client 103.163.161.30:50880] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/222.php"] [unique_id "aSIWjskLwhNGnt-ns6aUbQAAAIQ"]
[Sun Nov 23 04:01:19.105871 2025] [:error] [pid 56181:tid 56241] [client 103.163.161.30:50966] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/files.php"] [unique_id "aSIWj8kLwhNGnt-ns6aUdwAAAIA"]
[Sun Nov 23 04:01:19.373159 2025] [:error] [pid 56181:tid 56241] [client 103.163.161.30:51060] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-editor.php"] [unique_id "aSIWj8kLwhNGnt-ns6aUhQAAAIA"]
[Sun Nov 23 05:21:22.400349 2025] [:error] [pid 44652:tid 44721] [client 216.126.225.91:39512] [client 216.126.225.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aSIpUtiQFwsyXQDhwyDEOwAAAQ8"]
[Sun Nov 23 09:29:53.106903 2025] [:error] [pid 38740:tid 38818] [client 91.107.187.184:35924] [client 91.107.187.184] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.107.187.184, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aSJjkQ13QPZSi6O8umXm7gAAAJY"]
[Sun Nov 23 09:29:58.333978 2025] [:error] [pid 38824:tid 38833] [client 57.129.24.131:33950] [client 57.129.24.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 57.129.24.131, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aSJjlk8WZjXLvbHTHPcWzQAAAMY"]
[Sun Nov 23 12:58:49.112263 2025] [:error] [pid 38824:tid 38839] [client 68.218.21.123:65072] [client 68.218.21.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.218.21.123, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aSKUiU8WZjXLvbHTHPdPTAAAAMw"]
[Sun Nov 23 12:58:49.837337 2025] [proxy_fcgi:error] [pid 44652:tid 44724] [client 68.218.21.123:65065] AH01071: Got error 'PHP message: PHP Warning: Use of undefined constant ABSPATH - assumed 'ABSPATH' (this will throw an Error in a future version of PHP) in /home/perthactivecom/public_html/wp-settings.php on line 33PHP message: PHP Warning: require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/perthactivecom/public_html/wp-settings.php on line 33PHP message: PHP Warning: require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/perthactivecom/public_html/wp-settings.php on line 33PHP message: PHP Fatal error: require(): Failed opening required 'ABSPATHwp-includes/version.php' (include_path='.:') in /home/perthactivecom/public_html/wp-settings.php on line 33'
[Sun Nov 23 12:58:50.077989 2025] [:error] [pid 38738:tid 38742] [client 68.218.21.123:65031] [client 68.218.21.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.218.21.123, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aSKUigytc6TL9XavPmNw7wAAAAA"]
[Sun Nov 23 12:58:55.631078 2025] [:error] [pid 44652:tid 44707] [client 68.218.21.123:55106] [client 68.218.21.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSKUj9iQFwsyXQDhwyBMpQAAAQE"]
[Sun Nov 23 12:58:55.710074 2025] [:error] [pid 38738:tid 38758] [client 68.218.21.123:55048] [client 68.218.21.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSKUjwytc6TL9XavPmNxDQAAABA"]
[Sun Nov 23 21:13:21.962045 2025] [proxy_fcgi:error] [pid 44652:tid 44722] [client 128.24.86.41:39931] AH01071: Got error 'Primary script unknown', referer: https://duckduckgo.com/
[Sun Nov 23 21:13:22.171734 2025] [:error] [pid 44652:tid 44728] [client 128.24.86.41:39931] [client 128.24.86.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSMIctiQFwsyXQDhwyAeKAAAARY"], referer: https://duckduckgo.com/
[Sun Nov 23 21:13:22.802179 2025] [:error] [pid 44652:tid 44719] [client 128.24.86.41:39910] [client 128.24.86.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "aSMIctiQFwsyXQDhwyAeKQAAAQ0"], referer: https://www.bing.com/
[Sun Nov 23 21:13:25.456478 2025] [proxy_fcgi:error] [pid 14602:tid 14642] [client 128.24.86.41:39908] AH01071: Got error 'Primary script unknown', referer: https://duckduckgo.com/
[Sun Nov 23 21:13:28.291335 2025] [:error] [pid 14602:tid 14623] [client 128.24.86.41:39883] [client 128.24.86.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/wso112233.php"] [unique_id "aSMIeB-I77jdD81pU-nsCAAAAUI"], referer: https://www.google.co.uk/
[Sun Nov 23 21:13:31.867129 2025] [proxy_fcgi:error] [pid 38824:tid 38845] [client 128.24.86.41:39830] AH01071: Got error 'Primary script unknown', referer: https://www.google.co.uk/
[Sun Nov 23 21:13:34.404282 2025] [:error] [pid 44652:tid 44727] [client 128.24.86.41:39854] [client 128.24.86.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/shell20211028.php"] [unique_id "aSMIftiQFwsyXQDhwyAeOwAAARU"], referer: https://www.google.fr/
[Sun Nov 23 21:13:38.151284 2025] [proxy_fcgi:error] [pid 44652:tid 44711] [client 128.24.86.41:39903] AH01071: Got error 'Primary script unknown', referer: https://www.yahoo.com/
[Sun Nov 23 21:13:40.653429 2025] [:error] [pid 38738:tid 38746] [client 128.24.86.41:39876] [client 128.24.86.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/bala.php"] [unique_id "aSMIhAytc6TL9XavPmNQmAAAAAQ"], referer: https://www.yahoo.com/
[Sun Nov 23 21:13:43.064960 2025] [:error] [pid 44652:tid 44723] [client 128.24.86.41:39818] [client 128.24.86.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/dropdown.php"] [unique_id "aSMIh9iQFwsyXQDhwyAeVAAAARE"], referer: https://www.google.de/
[Sun Nov 23 21:13:47.463431 2025] [:error] [pid 44652:tid 44719] [client 128.24.86.41:39925] [client 128.24.86.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/repeater.php"] [unique_id "aSMIi9iQFwsyXQDhwyAeWwAAAQ0"], referer: https://www.bing.com/
[Sun Nov 23 21:14:01.985277 2025] [:error] [pid 38740:tid 38818] [client 128.24.86.41:39836] [client 128.24.86.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 128.24.86.41, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aSMImQ13QPZSi6O8umXzsgAAAJY"], referer: https://www.yahoo.com/
[Sun Nov 23 21:50:11.017051 2025] [:error] [pid 44652:tid 44716] [client 91.107.139.110:46206] [client 91.107.139.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.107.139.110, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aSMRE9iQFwsyXQDhwyAqqwAAAQo"]
[Sun Nov 23 21:50:16.380849 2025] [:error] [pid 14602:tid 14634] [client 104.28.163.173:9668] [client 104.28.163.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.28.163.173, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aSMRGB-I77jdD81pU-ny5gAAAU0"]
[Mon Nov 24 00:41:52.738843 2025] [autoindex:error] [pid 1589:tid 1604] [client 157.173.101.17:55755] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Nov 24 02:16:40.389011 2025] [:error] [pid 1452:tid 1476] [client 138.197.126.186:59824] [client 138.197.126.186] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "aSNPiBKZkEEyVNVXr_nSkgAAAFM"]
[Mon Nov 24 02:16:41.320033 2025] [:error] [pid 8337:tid 8343] [client 138.197.126.186:54914] [client 138.197.126.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.126.186, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aSNPieSmps4S2j95D5iR9AAAAAQ"]
[Mon Nov 24 08:21:08.990402 2025] [:error] [pid 49900:tid 49916] [client 103.65.237.124:62497] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "aSOk9DCyPLrvg06aorllrQAAAA4"]
[Mon Nov 24 08:21:09.367303 2025] [:error] [pid 49900:tid 49923] [client 103.65.237.124:58462] [client 103.65.237.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.vscode/sftp.json"] [unique_id "aSOk9TCyPLrvg06aorllsgAAABU"]
[Mon Nov 24 21:45:41.276241 2025] [:error] [pid 49900:tid 49916] [client 193.32.126.212:57294] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aSRhhTCyPLrvg06aorlJoAAAAA4"]
[Mon Nov 24 21:45:41.772751 2025] [:error] [pid 16516:tid 16519] [client 193.32.126.212:57524] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aSRhhfqZbniwaNwL8XkMhwAAAQA"]
[Mon Nov 24 21:45:42.266204 2025] [:error] [pid 16593:tid 16616] [client 193.32.126.212:57838] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aSRhhhVGznHBJI2LKpRsGAAAApU"]
[Mon Nov 24 22:24:33.709584 2025] [:error] [pid 49900:tid 49921] [client 45.141.215.153:36634] [client 45.141.215.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aSRqoTCyPLrvg06aorlRVAAAABM"]
[Mon Nov 24 22:24:33.710157 2025] [:error] [pid 16441:tid 16467] [client 45.141.215.153:36644] [client 45.141.215.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aSRqoYq_bc5MOa9HflmhyAAAAJc"]
[Tue Nov 25 04:13:12.263143 2025] [:error] [pid 14688:tid 14711] [client 165.154.38.157:58534] [client 165.154.38.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.154.38.157, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aSS8WG9vYrBoEsiDnizL0QAAARU"]
[Tue Nov 25 15:40:11.617581 2025] [:error] [pid 28740:tid 28812] [client 94.247.172.129:40617] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.perthactive.com.au|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.perthactive.com.au"] [uri "/"] [unique_id "aSVdW1ppQCoYxWW6V0U6gAAAAlU"]
[Tue Nov 25 16:41:39.719418 2025] [:error] [pid 28836:tid 28959] [client 45.55.90.116:57001] [client 45.55.90.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.55.90.116, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aSVrw5wNRsoxcLQGkTeZdQAAAsQ"]
[Tue Nov 25 18:08:28.183327 2025] [:error] [pid 14076:tid 14086] [client 54.173.250.15:34430] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aSWAHHsB4Gz6Qw-pvBv-NAAAAAU"]
[Tue Nov 25 18:20:35.972158 2025] [:error] [pid 28842:tid 29004] [client 20.119.245.193:7620] [client 20.119.245.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSWC89NmoaPf6T4-6C15lgAAA04"]
[Tue Nov 25 18:22:11.863270 2025] [:error] [pid 28842:tid 28999] [client 20.119.245.193:7308] [client 20.119.245.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSWDU9NmoaPf6T4-6C16FwAAA0k"]
[Tue Nov 25 18:22:13.853484 2025] [:error] [pid 28739:tid 28767] [client 20.119.245.193:5483] [client 20.119.245.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSWDVRxGpKmlkG4FexRpWwAAAgU"]
[Tue Nov 25 18:22:28.681228 2025] [:error] [pid 14168:tid 14185] [client 20.119.245.193:6884] [client 20.119.245.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSWDZPR-ZDU0QEgAIItVUAAAAM4"]
[Tue Nov 25 18:22:41.325448 2025] [:error] [pid 28836:tid 29010] [client 20.119.245.193:5472] [client 20.119.245.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSWDcZwNRsoxcLQGkTevwgAAAtQ"]
[Tue Nov 25 18:23:05.196532 2025] [:error] [pid 14078:tid 14143] [client 20.119.245.193:10235] [client 20.119.245.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSWDidVXYbb0ii_rVoIvzwAAAIY"]
[Tue Nov 25 18:23:06.998195 2025] [:error] [pid 28740:tid 28809] [client 20.119.245.193:10903] [client 20.119.245.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aSWDilppQCoYxWW6V0VpjgAAAlI"]
[Tue Nov 25 18:23:07.948787 2025] [:error] [pid 14168:tid 14176] [client 20.119.245.193:5462] [client 20.119.245.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tiny.php"] [unique_id "aSWDi_R-ZDU0QEgAIItViAAAAMU"]
[Tue Nov 25 18:23:15.260475 2025] [proxy_fcgi:error] [pid 14077:tid 14112] [client 20.119.245.193:4010] AH01071: Got error 'Primary script unknown'
[Tue Nov 25 18:23:19.518449 2025] [:error] [pid 28740:tid 28793] [client 20.119.245.193:10233] [client 20.119.245.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aSWDl1ppQCoYxWW6V0VpnQAAAkI"]
[Tue Nov 25 18:23:25.549655 2025] [proxy_fcgi:error] [pid 14078:tid 14154] [client 20.119.245.193:2176] AH01071: Got error 'Primary script unknown'
[Tue Nov 25 23:10:19.648500 2025] [:error] [pid 14078:tid 14153] [client 172.176.217.135:38784] [client 172.176.217.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSXG29VXYbb0ii_rVoKqXgAAAJA"]
[Tue Nov 25 23:10:26.646583 2025] [:error] [pid 14077:tid 14130] [client 172.176.217.135:38799] [client 172.176.217.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSXG4hG9n7UHEkwDTyjndwAAAFQ"]
[Tue Nov 25 23:10:27.729993 2025] [:error] [pid 14078:tid 14158] [client 172.176.217.135:38873] [client 172.176.217.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSXG49VXYbb0ii_rVoKqYwAAAJU"]
[Tue Nov 25 23:10:30.025874 2025] [:error] [pid 14076:tid 14101] [client 172.176.217.135:38851] [client 172.176.217.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSXG5nsB4Gz6Qw-pvBtgKQAAABQ"]
[Wed Nov 26 03:19:42.422390 2025] [:error] [pid 47045:tid 47104] [client 54.173.250.15:55464] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "aSYBThsL_waSUMFH0J730AAAAFA"]
[Wed Nov 26 08:05:56.926638 2025] [:error] [pid 34743:tid 34789] [client 213.21.239.4:34972] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/database/.git/config"] [unique_id "aSZEZAvyX7Q5oU7_mBxUDgAAAU0"]
[Wed Nov 26 08:05:56.927421 2025] [:error] [pid 34744:tid 34808] [client 213.21.239.4:34998] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/content../.git/config"] [unique_id "aSZEZEtgOvVbhyALkTSrAgAAAYU"]
[Wed Nov 26 08:05:56.929613 2025] [:error] [pid 34830:tid 34837] [client 213.21.239.4:34854] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/developer/.git/config"] [unique_id "aSZEZEukvkWgWN6jCR1fDwAAAAU"]
[Wed Nov 26 08:05:56.930284 2025] [:error] [pid 34830:tid 34855] [client 213.21.239.4:34994] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive/;/.git/config"] [unique_id "aSZEZEukvkWgWN6jCR1fEAAAABc"]
[Wed Nov 26 08:05:56.930421 2025] [:error] [pid 45836:tid 45868] [client 213.21.239.4:34996] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.git/config"] [unique_id "aSZEZJfrnOGqL-seZAzmLAAAANY"]
[Wed Nov 26 08:05:56.932858 2025] [:error] [pid 34830:tid 34852] [client 213.21.239.4:35034] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive/static../.git/config"] [unique_id "aSZEZEukvkWgWN6jCR1fEQAAABQ"]
[Wed Nov 26 08:05:56.934436 2025] [:error] [pid 45836:tid 45863] [client 213.21.239.4:34880] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive../.git/config"] [unique_id "aSZEZJfrnOGqL-seZAzmLgAAANE"]
[Wed Nov 26 08:05:56.939676 2025] [:error] [pid 34744:tid 34814] [client 213.21.239.4:35038] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/common/.git/config"] [unique_id "aSZEZEtgOvVbhyALkTSrAwAAAYs"]
[Wed Nov 26 08:05:56.940456 2025] [:error] [pid 45836:tid 45859] [client 213.21.239.4:34894] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive/.git/config;.."] [unique_id "aSZEZJfrnOGqL-seZAzmLwAAAM0"]
[Wed Nov 26 08:05:56.946123 2025] [:error] [pid 45836:tid 45862] [client 213.21.239.4:34892] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive/.git/config"] [unique_id "aSZEZJfrnOGqL-seZAzmMAAAANA"]
[Wed Nov 26 08:05:56.946127 2025] [:error] [pid 34830:tid 34839] [client 213.21.239.4:34868] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/backup/.git/config"] [unique_id "aSZEZEukvkWgWN6jCR1fEgAAAAc"]
[Wed Nov 26 08:05:56.947244 2025] [:error] [pid 34744:tid 34806] [client 213.21.239.4:34918] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive/.git/config;"] [unique_id "aSZEZEtgOvVbhyALkTSrBAAAAYM"]
[Wed Nov 26 08:05:56.948066 2025] [:error] [pid 34830:tid 34844] [client 213.21.239.4:34928] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/admin/.git/config"] [unique_id "aSZEZEukvkWgWN6jCR1fFAAAAAw"]
[Wed Nov 26 08:05:56.948905 2025] [:error] [pid 34744:tid 34821] [client 213.21.239.4:34944] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/application/.git/config"] [unique_id "aSZEZEtgOvVbhyALkTSrBQAAAZI"]
[Wed Nov 26 08:05:56.953343 2025] [:error] [pid 45836:tid 45869] [client 213.21.239.4:34946] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/app/.git/config"] [unique_id "aSZEZJfrnOGqL-seZAzmMQAAANc"]
[Wed Nov 26 08:05:56.955025 2025] [:error] [pid 34744:tid 34817] [client 213.21.239.4:34988] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive/..;/.git/config"] [unique_id "aSZEZEtgOvVbhyALkTSrBgAAAY4"]
[Wed Nov 26 08:05:56.955823 2025] [:error] [pid 34743:tid 34781] [client 213.21.239.4:35052] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive/.git/%0Aconfig"] [unique_id "aSZEZAvyX7Q5oU7_mBxUEAAAAUU"]
[Wed Nov 26 08:05:56.955823 2025] [:error] [pid 34744:tid 34826] [client 213.21.239.4:35012] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/assets../.git/config"] [unique_id "aSZEZEtgOvVbhyALkTSrBwAAAZc"]
[Wed Nov 26 08:05:56.958706 2025] [:error] [pid 34742:tid 34759] [client 213.21.239.4:34910] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/dev/.git/config"] [unique_id "aSZEZJSuLNwpQF_jzAf67AAAAEs"]
[Wed Nov 26 08:05:56.965604 2025] [:error] [pid 34742:tid 34749] [client 213.21.239.4:35040] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/css../.git/config"] [unique_id "aSZEZJSuLNwpQF_jzAf67gAAAEE"]
[Wed Nov 26 08:05:59.015377 2025] [:error] [pid 34744:tid 34813] [client 213.21.239.4:35272] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au../.git/config"] [unique_id "aSZEZ0tgOvVbhyALkTSrDwAAAYo"]
[Wed Nov 26 08:05:59.017274 2025] [:error] [pid 34830:tid 34855] [client 213.21.239.4:35298] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au/.git/config"] [unique_id "aSZEZ0ukvkWgWN6jCR1fGgAAABc"]
[Wed Nov 26 08:05:59.030143 2025] [:error] [pid 34742:tid 34766] [client 213.21.239.4:35310] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au/.git/config;"] [unique_id "aSZEZ5SuLNwpQF_jzAf68AAAAFI"]
[Wed Nov 26 08:05:59.033839 2025] [:error] [pid 45836:tid 45870] [client 213.21.239.4:35414] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/%0Aconfig"] [unique_id "aSZEZ5frnOGqL-seZAzmNQAAANg"]
[Wed Nov 26 08:05:59.039135 2025] [:error] [pid 34744:tid 34806] [client 213.21.239.4:35468] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config;"] [unique_id "aSZEZ0tgOvVbhyALkTSrEgAAAYM"]
[Wed Nov 26 08:05:59.041735 2025] [:error] [pid 34830:tid 34842] [client 213.21.239.4:35382] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au/.git/%0Aconfig"] [unique_id "aSZEZ0ukvkWgWN6jCR1fIQAAAAo"]
[Wed Nov 26 08:05:59.042118 2025] [:error] [pid 34742:tid 34762] [client 213.21.239.4:35378] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au/;/.git/config"] [unique_id "aSZEZ5SuLNwpQF_jzAf69AAAAE4"]
[Wed Nov 26 08:05:59.042266 2025] [:error] [pid 45836:tid 45850] [client 213.21.239.4:35492] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/js../.git/config"] [unique_id "aSZEZ5frnOGqL-seZAzmOAAAAMQ"]
[Wed Nov 26 08:05:59.043335 2025] [:error] [pid 34743:tid 34795] [client 213.21.239.4:35490] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/img../.git/config"] [unique_id "aSZEZwvyX7Q5oU7_mBxUEgAAAVM"]
[Wed Nov 26 08:05:59.048664 2025] [:error] [pid 45901:tid 45918] [client 213.21.239.4:35458] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aSZEZyunQ1SpfPRNrtxKLQAAAQ8"]
[Wed Nov 26 08:05:59.052928 2025] [:error] [pid 45901:tid 45915] [client 213.21.239.4:35342] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/;/.git/config"] [unique_id "aSZEZyunQ1SpfPRNrtxKMAAAAQw"]
[Wed Nov 26 08:05:59.053388 2025] [:error] [pid 34743:tid 34797] [client 213.21.239.4:35444] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config;.."] [unique_id "aSZEZwvyX7Q5oU7_mBxUEwAAAVU"]
[Wed Nov 26 08:05:59.053644 2025] [:error] [pid 45901:tid 45925] [client 213.21.239.4:35360] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/git/.git/config"] [unique_id "aSZEZyunQ1SpfPRNrtxKMQAAARY"]
[Wed Nov 26 08:05:59.054704 2025] [:error] [pid 34742:tid 34768] [client 213.21.239.4:35428] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/..;/.git/config"] [unique_id "aSZEZ5SuLNwpQF_jzAf69QAAAFQ"]
[Wed Nov 26 08:05:59.057504 2025] [:error] [pid 34744:tid 34821] [client 213.21.239.4:35474] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/live/.git/config"] [unique_id "aSZEZ0tgOvVbhyALkTSrFAAAAZI"]
[Wed Nov 26 08:05:59.058169 2025] [:error] [pid 34744:tid 34817] [client 213.21.239.4:35498] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/lib../.git/config"] [unique_id "aSZEZ0tgOvVbhyALkTSrFQAAAY4"]
[Wed Nov 26 08:05:59.063987 2025] [:error] [pid 35540:tid 35569] [client 213.21.239.4:35316] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au/.git/config;.."] [unique_id "aSZEZ8GrIq2A6SZSnkIAGQAAAJc"]
[Wed Nov 26 08:05:59.065156 2025] [:error] [pid 35540:tid 35559] [client 213.21.239.4:35330] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au/..;/.git/config"] [unique_id "aSZEZ8GrIq2A6SZSnkIAGgAAAI0"]
[Wed Nov 26 08:05:59.066496 2025] [:error] [pid 34744:tid 34809] [client 213.21.239.4:35482] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/m/.git/config"] [unique_id "aSZEZ0tgOvVbhyALkTSrFgAAAYY"]
[Wed Nov 26 08:05:59.067798 2025] [:error] [pid 34743:tid 34785] [client 213.21.239.4:35374] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/images../.git/config"] [unique_id "aSZEZwvyX7Q5oU7_mBxUFAAAAUk"]
[Wed Nov 26 08:05:59.071219 2025] [:error] [pid 45901:tid 45903] [client 213.21.239.4:35486] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/message-api/.git/config"] [unique_id "aSZEZyunQ1SpfPRNrtxKNAAAAQA"]
[Wed Nov 26 08:05:59.072385 2025] [:error] [pid 34744:tid 34826] [client 213.21.239.4:35398] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au/static../.git/config"] [unique_id "aSZEZ0tgOvVbhyALkTSrFwAAAZc"]
[Wed Nov 26 08:06:02.001918 2025] [:error] [pid 34743:tid 34791] [client 213.21.239.4:56784] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au/.git/config"] [unique_id "aSZEagvyX7Q5oU7_mBxUFQAAAU8"]
[Wed Nov 26 08:06:02.001979 2025] [:error] [pid 34743:tid 34779] [client 213.21.239.4:56766] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au/static../.git/config"] [unique_id "aSZEagvyX7Q5oU7_mBxUFgAAAUM"]
[Wed Nov 26 08:06:02.002464 2025] [:error] [pid 35540:tid 35553] [client 213.21.239.4:56828] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/prod/.git/config"] [unique_id "aSZEasGrIq2A6SZSnkIAHAAAAIc"]
[Wed Nov 26 08:06:02.013247 2025] [:error] [pid 45901:tid 45908] [client 213.21.239.4:56830] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/../.git/config"] [unique_id "aSZEaiunQ1SpfPRNrtxKNwAAAQU"]
[Wed Nov 26 08:06:02.022134 2025] [:error] [pid 45901:tid 45927] [client 213.21.239.4:56834] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/..;/.git/config"] [unique_id "aSZEaiunQ1SpfPRNrtxKOAAAARg"]
[Wed Nov 26 08:06:02.022824 2025] [:error] [pid 34830:tid 34840] [client 213.21.239.4:56832] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au/.git/%0Aconfig"] [unique_id "aSZEakukvkWgWN6jCR1fJQAAAAg"]
[Wed Nov 26 08:06:02.023960 2025] [:error] [pid 34743:tid 34782] [client 213.21.239.4:56980] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/public/.git/config"] [unique_id "aSZEagvyX7Q5oU7_mBxUGQAAAUY"]
[Wed Nov 26 08:06:02.026442 2025] [:error] [pid 34744:tid 34825] [client 213.21.239.4:56800] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/new/.git/config"] [unique_id "aSZEaktgOvVbhyALkTSrHwAAAZY"]
[Wed Nov 26 08:06:02.026942 2025] [core:error] [pid 34743:tid 34784] [client 213.21.239.4:56900] AH10244: invalid URI path (/../config)
[Wed Nov 26 08:06:02.029208 2025] [:error] [pid 34743:tid 34789] [client 213.21.239.4:56714] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au/.git/config;.."] [unique_id "aSZEagvyX7Q5oU7_mBxUGwAAAU0"]
[Wed Nov 26 08:06:02.031825 2025] [:error] [pid 34743:tid 34794] [client 213.21.239.4:56712] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au/.git/config;"] [unique_id "aSZEagvyX7Q5oU7_mBxUHQAAAVI"]
[Wed Nov 26 08:06:02.033093 2025] [:error] [pid 34830:tid 34849] [client 213.21.239.4:57040] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config;"] [unique_id "aSZEakukvkWgWN6jCR1fKAAAABE"]
[Wed Nov 26 08:06:02.033418 2025] [:error] [pid 45836:tid 45847] [client 213.21.239.4:56852] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aSZEapfrnOGqL-seZAzmPgAAAME"]
[Wed Nov 26 08:06:02.039396 2025] [:error] [pid 34743:tid 34777] [client 213.21.239.4:56750] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au/;/.git/config"] [unique_id "aSZEagvyX7Q5oU7_mBxUHgAAAUE"]
[Wed Nov 26 08:06:02.042048 2025] [:error] [pid 35540:tid 35554] [client 213.21.239.4:56914] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/;/.git/config"] [unique_id "aSZEasGrIq2A6SZSnkIAIQAAAIg"]
[Wed Nov 26 08:06:02.042832 2025] [:error] [pid 34830:tid 34851] [client 213.21.239.4:57008] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/qa/.git/config"] [unique_id "aSZEakukvkWgWN6jCR1fKgAAABM"]
[Wed Nov 26 08:06:02.049211 2025] [:error] [pid 45901:tid 45914] [client 213.21.239.4:56808] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/%0Aconfig"] [unique_id "aSZEaiunQ1SpfPRNrtxKOwAAAQs"]
[Wed Nov 26 08:06:02.050362 2025] [:error] [pid 35540:tid 35549] [client 213.21.239.4:56954] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au/..;/.git/config"] [unique_id "aSZEasGrIq2A6SZSnkIAIgAAAIM"]
[Wed Nov 26 08:06:02.052177 2025] [:error] [pid 34830:tid 34853] [client 213.21.239.4:57052] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config;.."] [unique_id "aSZEakukvkWgWN6jCR1fLAAAABU"]
[Wed Nov 26 08:06:02.056487 2025] [:error] [pid 34830:tid 34838] [client 213.21.239.4:57104] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au../.git/config"] [unique_id "aSZEakukvkWgWN6jCR1fLQAAAAY"]
[Wed Nov 26 08:06:04.996659 2025] [:error] [pid 35540:tid 35569] [client 213.21.239.4:57138] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/.git/config"] [unique_id "aSZEbMGrIq2A6SZSnkIAJgAAAJc"]
[Wed Nov 26 08:06:05.003221 2025] [:error] [pid 34742:tid 34750] [client 213.21.239.4:57142] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/static../.git/config"] [unique_id "aSZEbZSuLNwpQF_jzAf7AQAAAEI"]
[Wed Nov 26 08:06:05.010489 2025] [:error] [pid 34830:tid 34848] [client 213.21.239.4:57152] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/staging/.git/config"] [unique_id "aSZEbUukvkWgWN6jCR1fOAAAABA"]
[Wed Nov 26 08:06:05.010499 2025] [:error] [pid 34744:tid 34826] [client 213.21.239.4:57156] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/static../.git/config"] [unique_id "aSZEbUtgOvVbhyALkTSrJAAAAZc"]
[Wed Nov 26 08:06:05.016237 2025] [:error] [pid 45836:tid 45852] [client 213.21.239.4:57208] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/wp-content/.git/config"] [unique_id "aSZEbZfrnOGqL-seZAzmQgAAAMY"]
[Wed Nov 26 08:06:05.021521 2025] [:error] [pid 35540:tid 35568] [client 213.21.239.4:57232] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/web/.git/config"] [unique_id "aSZEbcGrIq2A6SZSnkIAKAAAAJY"]
[Wed Nov 26 08:06:05.022169 2025] [:error] [pid 34742:tid 34772] [client 213.21.239.4:57190] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/uat/.git/config"] [unique_id "aSZEbZSuLNwpQF_jzAf7AwAAAFg"]
[Wed Nov 26 08:06:05.035652 2025] [:error] [pid 34742:tid 34766] [client 213.21.239.4:57236] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/.git/config"] [unique_id "aSZEbZSuLNwpQF_jzAf7BAAAAFI"]
[Wed Nov 26 11:30:24.891359 2025] [autoindex:error] [pid 35540:tid 35568] [client 84.247.171.133:61340] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Nov 26 16:44:10.545847 2025] [autoindex:error] [pid 45685:tid 45753] [client 52.254.81.3:3372] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Wed Nov 26 16:44:10.790435 2025] [:error] [pid 45685:tid 45755] [client 52.254.81.3:3372] [client 52.254.81.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.254.81.3, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aSa92lj3f_NRdgU0DQ6zSgAAAQ0"], referer: https://www.google.com/
[Wed Nov 26 16:45:25.055304 2025] [:error] [pid 6471:tid 6493] [client 52.254.81.3:3475] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "aSa-Jeh3Z9TZLlRuTiNcjQAAAJM"], referer: https://www.google.de/
[Wed Nov 26 16:46:04.690769 2025] [autoindex:error] [pid 45684:tid 45736] [client 52.254.81.3:6822] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Wed Nov 26 16:46:04.898664 2025] [autoindex:error] [pid 45684:tid 45731] [client 52.254.81.3:6822] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Wed Nov 26 16:46:08.865199 2025] [autoindex:error] [pid 45684:tid 45728] [client 52.254.81.3:7603] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Wed Nov 26 16:46:14.781035 2025] [autoindex:error] [pid 6471:tid 6486] [client 52.254.81.3:2277] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Wed Nov 26 16:46:14.990394 2025] [:error] [pid 6471:tid 6497] [client 52.254.81.3:2277] [client 52.254.81.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.254.81.3, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aSa-Vuh3Z9TZLlRuTiNcsAAAAJc"], referer: https://duckduckgo.com/
[Wed Nov 26 16:46:16.331188 2025] [autoindex:error] [pid 45685:tid 45749] [client 52.254.81.3:6796] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Wed Nov 26 16:46:36.196283 2025] [:error] [pid 45769:tid 45796] [client 52.254.81.3:1910] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSa-bFdG5Eht9c3yy4P85gAAAdg"], referer: https://duckduckgo.com/
[Wed Nov 26 16:46:50.412367 2025] [autoindex:error] [pid 45684:tid 45738] [client 52.254.81.3:1172] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Wed Nov 26 16:46:56.822536 2025] [autoindex:error] [pid 45683:tid 45703] [client 52.254.81.3:1165] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Wed Nov 26 16:46:57.044189 2025] [:error] [pid 45683:tid 45701] [client 52.254.81.3:1165] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/404.php"] [unique_id "aSa-gRX1gQgNFW_222qFLwAAAU0"], referer: https://www.bing.com/
[Wed Nov 26 16:46:58.900505 2025] [autoindex:error] [pid 45684:tid 45730] [client 52.254.81.3:3596] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Wed Nov 26 16:46:59.105283 2025] [:error] [pid 45684:tid 45734] [client 52.254.81.3:3596] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSa-g_g5LMxwI4-PD1cO5AAAABM"], referer: https://www.google.de/
[Wed Nov 26 16:47:00.556108 2025] [:error] [pid 46443:tid 46449] [client 52.254.81.3:3615] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSa-hMLmDsnHrj-QFB-tvwAAAEQ"], referer: https://www.google.fr/
[Wed Nov 26 16:47:03.020851 2025] [:error] [pid 45769:tid 45796] [client 52.254.81.3:1308] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSa-h1dG5Eht9c3yy4P8_wAAAdg"], referer: https://duckduckgo.com/
[Wed Nov 26 16:47:09.445730 2025] [:error] [pid 45683:tid 45689] [client 52.254.81.3:6015] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/shortcode/index.php"] [unique_id "aSa-jRX1gQgNFW_222qFNgAAAUE"], referer: https://www.google.fr/
[Wed Nov 26 16:47:11.780428 2025] [autoindex:error] [pid 45683:tid 45703] [client 52.254.81.3:3763] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Wed Nov 26 16:47:13.216180 2025] [autoindex:error] [pid 45683:tid 45701] [client 52.254.81.3:3763] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Wed Nov 26 16:47:13.425018 2025] [:error] [pid 45683:tid 45709] [client 52.254.81.3:3763] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/widgets/about.php"] [unique_id "aSa-kRX1gQgNFW_222qFOwAAAVU"], referer: https://www.bing.com/
[Wed Nov 26 16:47:15.171287 2025] [autoindex:error] [pid 45684:tid 45722] [client 52.254.81.3:4930] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Wed Nov 26 16:47:15.394377 2025] [:error] [pid 45684:tid 45739] [client 52.254.81.3:4930] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aSa-k_g5LMxwI4-PD1cO-QAAABg"], referer: https://www.bing.com/
[Wed Nov 26 16:47:17.708443 2025] [:error] [pid 46443:tid 46448] [client 52.254.81.3:4168] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/admin.php"] [unique_id "aSa-lcLmDsnHrj-QFB-t5AAAAEM"], referer: https://www.google.de/
[Wed Nov 26 16:47:19.074776 2025] [:error] [pid 6471:tid 6483] [client 52.254.81.3:5960] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSa-l-h3Z9TZLlRuTiNdEAAAAIk"], referer: https://www.google.fr/
[Wed Nov 26 16:47:23.219118 2025] [autoindex:error] [pid 46443:tid 46450] [client 52.254.81.3:7126] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Wed Nov 26 16:47:23.426691 2025] [:error] [pid 46443:tid 46460] [client 52.254.81.3:7126] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSa-m8LmDsnHrj-QFB-uAgAAAE8"], referer: https://www.google.de/
[Wed Nov 26 16:47:24.241489 2025] [autoindex:error] [pid 45683:tid 45699] [client 52.254.81.3:5958] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Wed Nov 26 16:47:24.453496 2025] [autoindex:error] [pid 45683:tid 45692] [client 52.254.81.3:5958] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Wed Nov 26 16:47:24.667566 2025] [autoindex:error] [pid 45683:tid 45705] [client 52.254.81.3:5958] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Wed Nov 26 16:47:24.873129 2025] [:error] [pid 45683:tid 45694] [client 52.254.81.3:5958] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSa-nBX1gQgNFW_222qFbAAAAUY"], referer: https://www.yahoo.com/
[Wed Nov 26 16:47:25.868330 2025] [:error] [pid 45685:tid 45754] [client 52.254.81.3:6068] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aSa-nVj3f_NRdgU0DQ6z4QAAAQw"], referer: https://www.google.de/
[Wed Nov 26 16:47:26.638090 2025] [:error] [pid 46443:tid 46462] [client 52.254.81.3:7640] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSa-nsLmDsnHrj-QFB-uCwAAAFE"], referer: https://www.yahoo.com/
[Wed Nov 26 16:47:27.376057 2025] [:error] [pid 45685:tid 45748] [client 52.254.81.3:5753] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/jcrop/jcrop.php"] [unique_id "aSa-n1j3f_NRdgU0DQ6z5QAAAQY"], referer: https://www.google.com/
[Wed Nov 26 16:47:28.188422 2025] [autoindex:error] [pid 45684:tid 45731] [client 52.254.81.3:1313] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Wed Nov 26 16:47:28.397265 2025] [:error] [pid 45684:tid 45722] [client 52.254.81.3:1313] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aSa-oPg5LMxwI4-PD1cPGgAAAAc"], referer: https://duckduckgo.com/
[Wed Nov 26 16:47:29.240828 2025] [autoindex:error] [pid 46443:tid 46447] [client 52.254.81.3:3766] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/Cookie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Wed Nov 26 16:47:29.458663 2025] [autoindex:error] [pid 46443:tid 46450] [client 52.254.81.3:3766] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/Response/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Wed Nov 26 16:47:29.684315 2025] [autoindex:error] [pid 46443:tid 46463] [client 52.254.81.3:3766] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Wed Nov 26 16:47:29.926254 2025] [autoindex:error] [pid 46443:tid 46460] [client 52.254.81.3:3766] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Wed Nov 26 16:47:30.208257 2025] [autoindex:error] [pid 46443:tid 46455] [client 52.254.81.3:3766] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Wed Nov 26 16:47:30.424250 2025] [autoindex:error] [pid 46443:tid 46468] [client 52.254.81.3:3766] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Wed Nov 26 16:47:30.637112 2025] [autoindex:error] [pid 46443:tid 46448] [client 52.254.81.3:3766] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Wed Nov 26 16:47:30.846154 2025] [:error] [pid 46443:tid 46459] [client 52.254.81.3:3766] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aSa-osLmDsnHrj-QFB-uFwAAAE4"], referer: https://www.google.com/
[Wed Nov 26 16:47:31.412626 2025] [autoindex:error] [pid 45769:tid 45786] [client 52.254.81.3:6671] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Wed Nov 26 16:47:31.637685 2025] [:error] [pid 45769:tid 45775] [client 52.254.81.3:6671] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aSa-o1dG5Eht9c3yy4P9FQAAAcM"], referer: https://www.google.com/
[Wed Nov 26 16:47:32.455532 2025] [autoindex:error] [pid 46443:tid 46457] [client 52.254.81.3:7638] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Wed Nov 26 16:47:32.686488 2025] [autoindex:error] [pid 46443:tid 46463] [client 52.254.81.3:7638] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Wed Nov 26 16:47:32.898727 2025] [autoindex:error] [pid 46443:tid 46452] [client 52.254.81.3:7638] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Wed Nov 26 16:47:33.193089 2025] [autoindex:error] [pid 46443:tid 46455] [client 52.254.81.3:7638] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Wed Nov 26 16:47:33.446112 2025] [:error] [pid 46443:tid 46468] [client 52.254.81.3:7638] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSa-pcLmDsnHrj-QFB-uKQAAAFc"], referer: https://www.google.com/
[Wed Nov 26 16:47:34.528090 2025] [:error] [pid 45685:tid 45754] [client 52.254.81.3:1861] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aSa-plj3f_NRdgU0DQ6z7gAAAQw"], referer: https://www.google.com/
[Wed Nov 26 16:47:35.786753 2025] [autoindex:error] [pid 6471:tid 6491] [client 52.254.81.3:3736] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Wed Nov 26 16:47:35.998808 2025] [autoindex:error] [pid 6471:tid 6483] [client 52.254.81.3:3736] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Wed Nov 26 16:47:38.567302 2025] [autoindex:error] [pid 46443:tid 46445] [client 52.254.81.3:4199] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Wed Nov 26 16:49:17.574993 2025] [:error] [pid 45769:tid 45786] [client 52.254.81.3:7533] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aSa_DVdG5Eht9c3yy4P9dwAAAc4"], referer: https://www.google.fr/
[Wed Nov 26 16:49:26.241946 2025] [:error] [pid 6471:tid 6485] [client 52.254.81.3:2144] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/user/.env"] [unique_id "aSa_Fuh3Z9TZLlRuTiNebAAAAIs"], referer: https://www.yahoo.com/
[Wed Nov 26 16:49:47.926006 2025] [autoindex:error] [pid 45683:tid 45702] [client 52.254.81.3:4122] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Wed Nov 26 16:49:51.048319 2025] [:error] [pid 46443:tid 46466] [client 52.254.81.3:4847] [client 52.254.81.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.254.81.3, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aSa_L8LmDsnHrj-QFB-vZAAAAFU"], referer: https://www.yahoo.com/
[Wed Nov 26 16:49:53.009976 2025] [autoindex:error] [pid 6471:tid 6490] [client 52.254.81.3:4146] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Wed Nov 26 16:49:54.853825 2025] [autoindex:error] [pid 6471:tid 6488] [client 52.254.81.3:2215] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Wed Nov 26 16:50:11.737597 2025] [autoindex:error] [pid 45683:tid 45694] [client 52.254.81.3:3321] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/meta/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Wed Nov 26 16:50:26.157184 2025] [:error] [pid 45685:tid 45757] [client 52.254.81.3:5951] [client 52.254.81.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.254.81.3, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aSa_Ulj3f_NRdgU0DQ603wAAAQ8"], referer: https://duckduckgo.com/
[Wed Nov 26 16:50:53.497547 2025] [autoindex:error] [pid 45769:tid 45779] [client 52.254.81.3:6550] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Wed Nov 26 16:51:07.278404 2025] [:error] [pid 45684:tid 45720] [client 52.254.81.3:4139] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/about.php"] [unique_id "aSa_e_g5LMxwI4-PD1cQLQAAAAU"], referer: https://www.google.de/
[Wed Nov 26 16:51:11.976814 2025] [:error] [pid 45769:tid 45780] [client 52.254.81.3:8562] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSa_f1dG5Eht9c3yy4P-AQAAAcg"], referer: https://www.yahoo.com/
[Wed Nov 26 16:51:13.048736 2025] [:error] [pid 46443:tid 46458] [client 52.254.81.3:7103] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aSa_gcLmDsnHrj-QFB-v9QAAAE0"], referer: https://duckduckgo.com/
[Wed Nov 26 16:51:14.132756 2025] [:error] [pid 45684:tid 45722] [client 52.254.81.3:7271] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/site-title/index.php"] [unique_id "aSa_gvg5LMxwI4-PD1cQMQAAAAc"], referer: https://www.google.co.uk/
[Wed Nov 26 16:51:15.539074 2025] [:error] [pid 45769:tid 45790] [client 52.254.81.3:7827] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSa_g1dG5Eht9c3yy4P-DQAAAdI"], referer: https://www.google.co.uk/
[Wed Nov 26 16:51:16.733434 2025] [:error] [pid 45685:tid 45764] [client 52.254.81.3:7075] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aSa_hFj3f_NRdgU0DQ61iAAAARY"], referer: https://www.google.co.uk/
[Wed Nov 26 16:51:17.448499 2025] [:error] [pid 46443:tid 46467] [client 52.254.81.3:3015] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSa_hcLmDsnHrj-QFB-v-AAAAFY"], referer: https://www.yahoo.com/
[Wed Nov 26 16:51:18.805131 2025] [:error] [pid 45685:tid 45765] [client 52.254.81.3:2109] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/html-api/about.php"] [unique_id "aSa_hlj3f_NRdgU0DQ61kwAAARc"], referer: https://www.google.com/
[Wed Nov 26 16:51:19.883732 2025] [:error] [pid 46443:tid 46465] [client 52.254.81.3:4140] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aSa_h8LmDsnHrj-QFB-v-gAAAFQ"], referer: https://www.yahoo.com/
[Wed Nov 26 16:51:21.004969 2025] [:error] [pid 45684:tid 45731] [client 52.254.81.3:4108] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aSa_ifg5LMxwI4-PD1cQNgAAABA"], referer: https://www.google.fr/
[Wed Nov 26 16:51:22.586351 2025] [:error] [pid 45684:tid 45721] [client 52.254.81.3:8180] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aSa_ivg5LMxwI4-PD1cQNwAAAAY"], referer: https://www.google.de/
[Wed Nov 26 16:51:23.530579 2025] [:error] [pid 6471:tid 6480] [client 52.254.81.3:3071] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "aSa_i-h3Z9TZLlRuTiNfXQAAAIY"], referer: https://www.bing.com/
[Wed Nov 26 16:51:24.094933 2025] [:error] [pid 46443:tid 46458] [client 52.254.81.3:2695] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aSa_jMLmDsnHrj-QFB-v_gAAAE0"], referer: https://www.google.de/
[Wed Nov 26 16:51:25.304933 2025] [:error] [pid 6471:tid 6491] [client 52.254.81.3:2730] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/chosen.php"] [unique_id "aSa_jeh3Z9TZLlRuTiNfXgAAAJE"], referer: https://www.google.de/
[Wed Nov 26 16:51:25.992451 2025] [:error] [pid 45684:tid 45724] [client 52.254.81.3:2728] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aSa_jfg5LMxwI4-PD1cQOQAAAAk"], referer: https://www.bing.com/
[Wed Nov 26 16:51:27.247870 2025] [:error] [pid 6471:tid 6481] [client 52.254.81.3:6277] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSa_j-h3Z9TZLlRuTiNfYAAAAIc"], referer: https://www.google.com/
[Wed Nov 26 16:51:28.025868 2025] [:error] [pid 6471:tid 6479] [client 52.254.81.3:8575] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSa_kOh3Z9TZLlRuTiNfYgAAAIU"], referer: https://www.google.co.uk/
[Wed Nov 26 16:51:29.245526 2025] [:error] [pid 46443:tid 46463] [client 52.254.81.3:8163] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/include.php"] [unique_id "aSa_kcLmDsnHrj-QFB-wAQAAAFI"], referer: https://duckduckgo.com/
[Wed Nov 26 16:51:29.926597 2025] [:error] [pid 45685:tid 45751] [client 52.254.81.3:4963] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aSa_kVj3f_NRdgU0DQ61owAAAQk"], referer: https://www.google.co.uk/
[Wed Nov 26 16:51:31.107157 2025] [:error] [pid 45685:tid 45747] [client 52.254.81.3:8175] [client 52.254.81.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aSa_k1j3f_NRdgU0DQ61pQAAAQU"], referer: https://www.google.de/
[Wed Nov 26 16:52:21.716625 2025] [autoindex:error] [pid 46443:tid 46446] [client 52.254.81.3:3797] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Wed Nov 26 22:25:11.223840 2025] [:error] [pid 46443:tid 46446] [client 152.42.180.191:52313] [client 152.42.180.191] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "aScNx8LmDsnHrj-QFB8cbwAAAEE"]
[Wed Nov 26 23:15:45.892613 2025] [:error] [pid 45683:tid 45693] [client 136.144.19.141:49853] [client 136.144.19.141] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/txets.php"] [unique_id "aScZoRX1gQgNFW_222rfLgAAAUU"]
[Wed Nov 26 23:15:46.372352 2025] [:error] [pid 45684:tid 45730] [client 136.144.19.168:24539] [client 136.144.19.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/txets.php"] [unique_id "aScZovg5LMxwI4-PD1esawAAAA8"]
[Wed Nov 26 23:15:46.852179 2025] [:error] [pid 45685:tid 45743] [client 136.144.19.170:24237] [client 136.144.19.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/txets.php"] [unique_id "aScZolj3f_NRdgU0DQ4JQQAAAQE"]
[Wed Nov 26 23:17:00.025895 2025] [:error] [pid 46443:tid 46461] [client 216.126.239.203:60086] [client 216.126.239.203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aScZ7MLmDsnHrj-QFB8qpwAAAFA"]
[Thu Nov 27 00:55:03.782647 2025] [:error] [pid 8184:tid 8245] [client 103.77.107.57:60035] [client 103.77.107.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "aScw57-M2IHkRYVrcbN7SgAAAEg"]
[Thu Nov 27 03:28:03.881060 2025] [:error] [pid 22765:tid 22772] [client 122.54.131.0:61875] [client 122.54.131.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.54.131.0, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aSdUw_DnYoIqCLGR6UpvFAAAAMU"]
[Thu Nov 27 09:03:02.305657 2025] [:error] [pid 19015:tid 19093] [client 206.81.12.187:41520] [client 206.81.12.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||perthactive.com.au|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "perthactive.com.au"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aSejRg4MxyJWPPh2qEjGbAAAAJY"]
[Thu Nov 27 09:03:05.646481 2025] [authz_core:error] [pid 19013:tid 19022] [client 206.81.12.187:41570] AH01630: client denied by server configuration: /home/perthactivecom/public_html/server-status
[Thu Nov 27 09:03:07.119370 2025] [:error] [pid 19119:tid 19196] [client 143.244.168.161:35160] [client 143.244.168.161] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.perthactive.com.au|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.perthactive.com.au"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aSejSxsL_RTusriYkweETwAAANY"]
[Thu Nov 27 09:03:07.474897 2025] [:error] [pid 40009:tid 40068] [client 206.81.12.187:41602] [client 206.81.12.187] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aSejS0JuxjShta_KR6UDaAAAAUY"]
[Thu Nov 27 09:03:07.887959 2025] [:error] [pid 40009:tid 40086] [client 206.81.12.187:41616] [client 206.81.12.187] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aSejS0JuxjShta_KR6UDawAAAVY"]
[Thu Nov 27 09:03:11.871313 2025] [authz_core:error] [pid 40009:tid 40086] [client 143.244.168.161:35236] AH01630: client denied by server configuration: /home/perthactivecom/public_html/server-status
[Thu Nov 27 09:03:14.512656 2025] [:error] [pid 19119:tid 19182] [client 143.244.168.161:35276] [client 143.244.168.161] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env"] [unique_id "aSejUhsL_RTusriYkweEWwAAAMg"]
[Thu Nov 27 09:03:15.139466 2025] [:error] [pid 40009:tid 40082] [client 143.244.168.161:35290] [client 143.244.168.161] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "aSejU0JuxjShta_KR6UDgAAAAVI"]
[Thu Nov 27 09:22:12.931609 2025] [:error] [pid 19013:tid 19033] [client 104.28.246.116:48468] [client 104.28.246.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/style.php"] [unique_id "aSenxIaBrX8b6-N6_86gtgAAABA"]
[Tue Mar 10 16:38:01.371139 2026] [:error] [pid 21318:tid 21396] [client 62.164.177.15:50144] [client 62.164.177.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.svn/wc.db"] [unique_id "aa_YaRTTkPqKydpYiIJzFwAAAJY"]
[Tue Mar 10 17:59:37.764280 2026] [:error] [pid 51263:tid 51363] [client 77.90.185.116:50248] [client 77.90.185.116] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/HEAD"] [unique_id "aa_rieBZNQJj0PzgyEDmOAAAAIs"]
2026/03/11 00:39:59 [error] 6418#6418: *291911 access forbidden by rule, client: 34.139.126.232, server: perthactive.com.au, request: "GET /.git/config HTTP/1.1", host: "perthactive.com.au"
[Wed Mar 11 07:48:38.961747 2026] [:error] [pid 6117:tid 6154] [client 209.87.169.96:40664] [client 209.87.169.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abCt1sU0P9gyi5rKFp6j8AAAABI"]
[Wed Mar 11 12:32:39.801285 2026] [:error] [pid 53955:tid 54027] [client 188.241.103.36:44314] [client 188.241.103.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abDwZ9P1Uf6qBkbxZg-YHAAAAIg"]
[Wed Mar 11 13:42:56.484880 2026] [:error] [pid 53955:tid 54033] [client 209.38.16.10:43744] [client 209.38.16.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "abEA4NP1Uf6qBkbxZg-sGAAAAI4"]
2026/03/11 13:42:56 [error] 53939#53939: *787934 access forbidden by rule, client: 209.38.16.10, server: perthactive.com.au, request: "GET /.git/config HTTP/1.1", host: "perthactive.com.au"
[Wed Mar 11 19:42:34.213530 2026] [:error] [pid 23482:tid 23501] [client 34.132.59.73:42974] [client 34.132.59.73] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "abFVKsrYaTAnN_mLXynecAAAARA"]
[Wed Mar 11 19:42:34.730783 2026] [:error] [pid 44995:tid 45005] [client 34.132.59.73:42988] [client 34.132.59.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abFVKjoOSr9ks_axo6O4RQAAAkg"]
[Wed Mar 11 22:37:14.482180 2026] [:error] [pid 54045:tid 54053] [client 178.231.22.33:58720] [client 178.231.22.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abF-GiRcKzQ1f-N8TgT-VQAAAMY"]
[Wed Mar 11 22:38:03.151133 2026] [:error] [pid 45143:tid 45147] [client 106.215.174.174:59502] [client 106.215.174.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abF-SyEXSpYdWImkpzYJpgAAAYI"]
[Wed Mar 11 22:39:18.450683 2026] [:error] [pid 23482:tid 23494] [client 45.168.88.233:60658] [client 45.168.88.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abF-lsrYaTAnN_mLXyn16AAAAQk"]
[Thu Mar 12 04:02:14.932893 2026] [:error] [pid 63147:tid 63185] [client 172.98.33.18:42870] [client 172.98.33.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abHKRmNUKt1CWUFbzBdtdgAAABc"]
[Thu Mar 12 04:59:13.751428 2026] [:error] [pid 63256:tid 63264] [client 45.132.115.252:43324] [client 45.132.115.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abHXoQhgyalB3r3y_ThHdwAAAMA"]
[Thu Mar 12 14:03:10.945146 2026] [autoindex:error] [pid 22063:tid 22076] [client 173.249.30.252:55089] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Mar 12 18:25:24.290706 2026] [:error] [pid 51457:tid 51519] [client 103.65.236.149:53007] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "abKUlCjknw2FvT4H3DavaAAAAIU"]
[Thu Mar 12 18:25:25.766690 2026] [:error] [pid 22063:tid 22086] [client 103.65.236.149:53107] [client 103.65.236.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.vscode/sftp.json"] [unique_id "abKUla0RUhS-MJyHWLQcMAAAAhU"]
[Thu Mar 12 19:58:26.944095 2026] [:error] [pid 51456:tid 51507] [client 81.45.180.115:58562] [client 81.45.180.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.45.180.115, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abKqYhXu8LzVixNGr0tmBQAAAFQ"]
[Thu Mar 12 19:59:18.136564 2026] [:error] [pid 20530:tid 20606] [client 49.37.103.200:56589] [client 49.37.103.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.103.200, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abKqlgkNGxMzPO-s9qcF-gAAA5E"]
[Thu Mar 12 22:23:18.850708 2026] [:error] [pid 20467:tid 20485] [client 173.239.214.20:45235] [client 173.239.214.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.20, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abLMVnJ3UvosyIqy8ayxVQAAAo8"]
[Fri Mar 13 00:24:14.329160 2026] [:error] [pid 48029:tid 48051] [client 20.151.108.217:15559] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 18"] [hostname "perthactive.com.au"] [uri "/1.php"] [unique_id "abLorm7cFKMmtdGhPH-qggAAABQ"]
[Fri Mar 13 00:24:15.277383 2026] [:error] [pid 48029:tid 48042] [client 20.151.108.217:16008] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 18"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/2024/"] [unique_id "abLor27cFKMmtdGhPH-qgwAAAAs"]
[Fri Mar 13 00:24:16.229101 2026] [:error] [pid 47894:tid 48008] [client 20.151.108.217:15540] [client 20.151.108.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.108.217, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abLosJiuFpRtVNR6uOJrPgAAAQY"]
[Fri Mar 13 00:24:16.229156 2026] [:error] [pid 47894:tid 48008] [client 20.151.108.217:15540] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abLosJiuFpRtVNR6uOJrPgAAAQY"]
[Fri Mar 13 00:24:17.173362 2026] [:error] [pid 48029:tid 48039] [client 20.151.108.217:15502] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-corn-sample.php"] [unique_id "abLosW7cFKMmtdGhPH-qigAAAAg"]
[Fri Mar 13 00:24:18.129696 2026] [:error] [pid 47893:tid 47989] [client 20.151.108.217:15493] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/"] [unique_id "abLosgYSdu6aqxO_YucSnwAAAI4"]
[Fri Mar 13 00:24:19.053279 2026] [:error] [pid 47892:tid 47953] [client 20.151.108.217:16033] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "abLoszNdN5Yd7YcKfyX36QAAAEU"]
[Fri Mar 13 00:24:19.991310 2026] [:error] [pid 48029:tid 48039] [client 20.151.108.217:15560] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "abLos27cFKMmtdGhPH-qlwAAAAg"]
[Fri Mar 13 00:24:20.959812 2026] [:error] [pid 47894:tid 48012] [client 20.151.108.217:15614] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/server.php"] [unique_id "abLotJiuFpRtVNR6uOJrSwAAAQo"]
[Fri Mar 13 00:24:21.898438 2026] [:error] [pid 47894:tid 48025] [client 20.151.108.217:15611] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/library/"] [unique_id "abLotZiuFpRtVNR6uOJrTQAAARc"]
[Fri Mar 13 00:24:22.853047 2026] [:error] [pid 48029:tid 48048] [client 20.151.108.217:15609] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/"] [unique_id "abLotm7cFKMmtdGhPH-qoQAAABE"]
[Fri Mar 13 00:24:23.819839 2026] [:error] [pid 48029:tid 48040] [client 20.151.108.217:16056] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wso.php"] [unique_id "abLot27cFKMmtdGhPH-qpQAAAAk"]
[Fri Mar 13 00:24:24.742973 2026] [:error] [pid 47893:tid 47983] [client 20.151.108.217:15531] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "abLouAYSdu6aqxO_YucSpAAAAIg"]
[Fri Mar 13 00:24:25.643130 2026] [:error] [pid 48029:tid 48053] [client 20.151.108.217:16063] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-file.php"] [unique_id "abLouW7cFKMmtdGhPH-qrAAAABY"]
[Fri Mar 13 00:24:26.514028 2026] [:error] [pid 48029:tid 48036] [client 20.151.108.217:15505] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/adminfuns.php"] [unique_id "abLoum7cFKMmtdGhPH-qsQAAAAU"]
[Fri Mar 13 00:24:27.361723 2026] [:error] [pid 47894:tid 48019] [client 20.151.108.217:16001] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wk/index.php"] [unique_id "abLou5iuFpRtVNR6uOJrVQAAARE"]
[Fri Mar 13 00:24:28.208068 2026] [:error] [pid 47893:tid 47982] [client 20.151.108.217:15565] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-admin.php"] [unique_id "abLovAYSdu6aqxO_YucSqgAAAIc"]
[Fri Mar 13 00:24:29.048006 2026] [:error] [pid 48029:tid 48039] [client 20.151.108.217:15606] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "abLovW7cFKMmtdGhPH-quAAAAAg"]
[Fri Mar 13 00:24:29.876941 2026] [:error] [pid 47893:tid 47977] [client 20.151.108.217:16082] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-bindings/"] [unique_id "abLovQYSdu6aqxO_YucSqwAAAII"]
[Fri Mar 13 00:24:30.716893 2026] [:error] [pid 48029:tid 48046] [client 20.151.108.217:15577] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/xmrlpc.php"] [unique_id "abLovm7cFKMmtdGhPH-quwAAAA8"]
[Fri Mar 13 00:24:31.546289 2026] [:error] [pid 48029:tid 48051] [client 20.151.108.217:16002] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abLov27cFKMmtdGhPH-qvgAAABQ"]
[Fri Mar 13 00:24:32.371391 2026] [:error] [pid 48029:tid 48042] [client 20.151.108.217:15602] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-admin/file.php"] [unique_id "abLowG7cFKMmtdGhPH-qwAAAAAs"]
[Fri Mar 13 00:24:33.204717 2026] [:error] [pid 47893:tid 47985] [client 20.151.108.217:16084] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abLowQYSdu6aqxO_YucSrAAAAIo"]
[Fri Mar 13 00:24:34.027051 2026] [:error] [pid 47894:tid 48004] [client 20.151.108.217:15597] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/atomlib.php"] [unique_id "abLowpiuFpRtVNR6uOJrZwAAAQI"]
[Fri Mar 13 00:24:34.852542 2026] [:error] [pid 48029:tid 48051] [client 20.151.108.217:15605] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/css/index.php"] [unique_id "abLowm7cFKMmtdGhPH-qygAAABQ"]
[Fri Mar 13 00:24:35.681849 2026] [:error] [pid 47893:tid 47977] [client 20.151.108.217:16006] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-content/et-cache/"] [unique_id "abLowwYSdu6aqxO_YucSrwAAAII"]
[Fri Mar 13 00:24:36.510388 2026] [:error] [pid 48029:tid 48042] [client 20.151.108.217:16003] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/about.php"] [unique_id "abLoxG7cFKMmtdGhPH-qzwAAAAs"]
[Fri Mar 13 00:24:37.337056 2026] [:error] [pid 47892:tid 47950] [client 20.151.108.217:15506] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/admin.php"] [unique_id "abLoxTNdN5Yd7YcKfyX37QAAAEI"]
[Fri Mar 13 00:24:38.163107 2026] [:error] [pid 48029:tid 48032] [client 20.151.108.217:15496] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-content/index.php"] [unique_id "abLoxm7cFKMmtdGhPH-q2AAAAAE"]
[Fri Mar 13 00:24:39.004621 2026] [:error] [pid 48029:tid 48034] [client 20.151.108.217:15556] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "abLox27cFKMmtdGhPH-q3AAAAAM"]
[Fri Mar 13 00:24:39.828973 2026] [:error] [pid 48029:tid 48047] [client 20.151.108.217:16017] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/"] [unique_id "abLox27cFKMmtdGhPH-q5QAAABA"]
[Fri Mar 13 00:24:40.655696 2026] [:error] [pid 48029:tid 48048] [client 20.151.108.217:15583] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/admin.php"] [unique_id "abLoyG7cFKMmtdGhPH-q6wAAABE"]
[Fri Mar 13 00:24:41.485472 2026] [:error] [pid 48029:tid 48043] [client 20.151.108.217:15532] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/block/"] [unique_id "abLoyW7cFKMmtdGhPH-q8wAAAAw"]
[Fri Mar 13 00:24:42.320071 2026] [:error] [pid 47893:tid 47996] [client 20.151.108.217:16101] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/as.php"] [unique_id "abLoygYSdu6aqxO_YucStgAAAJU"]
[Fri Mar 13 00:24:43.151383 2026] [:error] [pid 47893:tid 47982] [client 20.151.108.217:16009] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "abLoywYSdu6aqxO_YucStwAAAIc"]
[Fri Mar 13 00:24:43.976368 2026] [:error] [pid 47894:tid 48017] [client 20.151.108.217:16073] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/buy.php"] [unique_id "abLoy5iuFpRtVNR6uOJrgAAAAQ8"]
[Fri Mar 13 00:24:44.814999 2026] [:error] [pid 47892:tid 47966] [client 20.151.108.217:16026] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp.php"] [unique_id "abLozDNdN5Yd7YcKfyX39AAAAFI"]
[Fri Mar 13 00:24:45.642575 2026] [:error] [pid 47894:tid 48023] [client 20.151.108.217:15500] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "abLozZiuFpRtVNR6uOJrhwAAARU"]
[Fri Mar 13 00:24:46.468149 2026] [:error] [pid 48029:tid 48046] [client 20.151.108.217:16038] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/about.PHP"] [unique_id "abLozm7cFKMmtdGhPH-rEgAAAA8"]
[Fri Mar 13 00:24:48.979491 2026] [:error] [pid 47893:tid 47979] [client 20.151.108.217:15598] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "abLo0AYSdu6aqxO_YucSwgAAAIQ"]
[Fri Mar 13 00:24:49.826959 2026] [:error] [pid 48029:tid 48040] [client 20.151.108.217:16007] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "abLo0W7cFKMmtdGhPH-rKAAAAAk"]
[Fri Mar 13 00:24:50.654839 2026] [:error] [pid 47892:tid 47968] [client 20.151.108.217:16023] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-content/edit.php"] [unique_id "abLo0jNdN5Yd7YcKfyX3-QAAAFQ"]
[Fri Mar 13 00:24:51.480718 2026] [:error] [pid 48029:tid 48037] [client 20.151.108.217:15579] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/sf.php"] [unique_id "abLo027cFKMmtdGhPH-rMAAAAAY"]
[Fri Mar 13 00:24:52.307389 2026] [:error] [pid 47894:tid 48019] [client 20.151.108.217:16020] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/index.php"] [unique_id "abLo1JiuFpRtVNR6uOJrlwAAARE"]
[Fri Mar 13 00:24:53.130064 2026] [:error] [pid 47894:tid 48020] [client 20.151.108.217:15570] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "abLo1ZiuFpRtVNR6uOJrmgAAARI"]
[Fri Mar 13 00:24:53.957280 2026] [:error] [pid 48029:tid 48031] [client 20.151.108.217:15585] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/modern/"] [unique_id "abLo1W7cFKMmtdGhPH-rMgAAAAA"]
[Fri Mar 13 00:24:54.793881 2026] [:error] [pid 47892:tid 47963] [client 20.151.108.217:15603] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/cgi-bin/"] [unique_id "abLo1jNdN5Yd7YcKfyX3-gAAAE8"]
[Fri Mar 13 00:24:55.618466 2026] [:error] [pid 48029:tid 48044] [client 20.151.108.217:15589] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/test1.php"] [unique_id "abLo127cFKMmtdGhPH-rNQAAAA0"]
[Fri Mar 13 00:24:56.443323 2026] [:error] [pid 48029:tid 48052] [client 20.151.108.217:15594] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-cron.php"] [unique_id "abLo2G7cFKMmtdGhPH-rNwAAABU"]
[Fri Mar 13 00:24:57.266787 2026] [:error] [pid 48029:tid 48055] [client 20.151.108.217:15575] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/"] [unique_id "abLo2W7cFKMmtdGhPH-rOgAAABg"]
[Fri Mar 13 00:24:58.092439 2026] [:error] [pid 48029:tid 48032] [client 20.151.108.217:15572] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/404.php"] [unique_id "abLo2m7cFKMmtdGhPH-rPAAAAAE"]
[Fri Mar 13 00:24:58.934400 2026] [:error] [pid 48029:tid 48045] [client 20.151.108.217:15574] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-content/1.php"] [unique_id "abLo2m7cFKMmtdGhPH-rQQAAAA4"]
[Fri Mar 13 00:24:59.756161 2026] [:error] [pid 47892:tid 47972] [client 20.151.108.217:15590] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/images/index.php"] [unique_id "abLo2zNdN5Yd7YcKfyX3_QAAAFg"]
[Fri Mar 13 01:37:05.142470 2026] [:error] [pid 56003:tid 56028] [client 193.36.225.32:35797] [client 193.36.225.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.32, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abL5wRQtM0oeMdFWe6VqKgAAANc"]
[Fri Mar 13 03:39:24.768593 2026] [:error] [pid 24731:tid 24828] [client 4.205.39.42:50492] [client 4.205.39.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.205.39.42, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abMWbBp_IhDOreux-KL2LgAAAQs"]
[Fri Mar 13 05:39:26.826709 2026] [:error] [pid 62036:tid 62056] [client 111.125.235.174:31631] [client 111.125.235.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.125.235.174, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abMyjrce6g9kILuh_R747gAAAM0"]
[Fri Mar 13 07:13:34.231304 2026] [:error] [pid 55077:tid 55098] [client 87.201.231.251:23052] [client 87.201.231.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.201.231.251, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abNInt9Ul5ym4M-PlQIJXAAAAVM"]
[Fri Mar 13 09:50:32.937549 2026] [:error] [pid 9111:tid 9133] [client 45.131.195.143:62587] [client 45.131.195.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.143, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abNtaE-M156SLpD2BrsTTgAAAYc"]
[Fri Mar 13 11:54:10.589481 2026] [:error] [pid 61928:tid 61993] [client 136.144.35.40:54371] [client 136.144.35.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.35.40, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abOKYgod66AHekJJZipi7gAAAFA"]
[Fri Mar 13 18:40:08.557935 2026] [:error] [pid 9309:tid 9341] [client 115.245.194.141:62697] [client 115.245.194.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.245.194.141, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abPpiKo1KEMMghNWAN8lGgAAAhI"]
[Sat Mar 14 00:30:58.433919 2026] [:error] [pid 47905:tid 48000] [client 20.151.4.179:3287] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/hp2.php"] [unique_id "abQ7whaYZayP4o4wpJcJcwAAAUc"]
[Sat Mar 14 00:30:59.261530 2026] [:error] [pid 47878:tid 47944] [client 20.151.4.179:3296] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/hp2.php"] [unique_id "abQ7w38jymmmpr1jcBeeEwAAAEU"]
[Sat Mar 14 00:31:00.099172 2026] [:error] [pid 47905:tid 48007] [client 20.151.4.179:3299] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/hp2.php"] [unique_id "abQ7xBaYZayP4o4wpJcJggAAAU4"]
[Sat Mar 14 00:31:00.925362 2026] [:error] [pid 48070:tid 48087] [client 20.151.4.179:3293] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/hp2.php"] [unique_id "abQ7xEIvrhMS5BVHxNn4EQAAAA8"]
[Sat Mar 14 01:38:01.096048 2026] [:error] [pid 47878:tid 47941] [client 4.204.197.4:2028] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "abRLeX8jymmmpr1jcBevfgAAAEI"]
[Sat Mar 14 01:38:01.508676 2026] [:error] [pid 47891:tid 47986] [client 4.204.197.4:1930] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "abRLefchNnuMqi7I_WH6tAAAAJQ"]
[Sat Mar 14 01:38:01.924515 2026] [:error] [pid 47905:tid 47999] [client 4.204.197.4:2018] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "abRLeRaYZayP4o4wpJcnBQAAAUY"]
[Sat Mar 14 01:38:02.356879 2026] [:error] [pid 48070:tid 48076] [client 4.204.197.4:2001] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "abRLekIvrhMS5BVHxNkkiQAAAAQ"]
[Sat Mar 14 05:24:40.205104 2026] [:error] [pid 3914:tid 3985] [client 51.89.43.80:57213] [client 51.89.43.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/cidaas-pro-master/composer.json"] [unique_id "abSAmPH_HeUqa_sn9-AHZwAAAIE"]
[Sat Mar 14 05:27:27.847146 2026] [:error] [pid 3914:tid 3991] [client 66.249.77.229:49659] [client 66.249.77.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.249.77.229, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abSBP_H_HeUqa_sn9-AH9AAAAIc"]
[Sat Mar 14 05:27:27.917600 2026] [:error] [pid 4018:tid 4036] [client 66.249.77.228:64753] [client 66.249.77.228] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.249.77.228, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abSBPwEk1fxdMMkDDaLSZAAAAMs"]
[Sat Mar 14 05:27:28.444910 2026] [:error] [pid 35801:tid 35827] [client 66.249.77.229:41844] [client 66.249.77.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.249.77.229, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abSBQG8tVFelXGsqbU-m0AAAARc"]
[Sat Mar 14 05:27:28.659873 2026] [:error] [pid 3914:tid 4005] [client 66.249.77.230:46965] [client 66.249.77.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.249.77.230, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abSBQPH_HeUqa_sn9-AH9QAAAJU"]
[Sat Mar 14 07:07:42.587589 2026] [:error] [pid 35801:tid 35812] [client 185.137.164.21:53159] [client 185.137.164.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/HEAD"] [unique_id "abSYvm8tVFelXGsqbU-_-AAAAQg"]
[Sat Mar 14 07:07:43.343474 2026] [:error] [pid 57226:tid 57233] [client 185.137.164.21:27145] [client 185.137.164.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/HEAD"] [unique_id "abSYv2xFlXQvNewjeI87FQAAAUM"]
[Sat Mar 14 11:09:07.215745 2026] [:error] [pid 57226:tid 57241] [client 119.93.234.129:57476] [client 119.93.234.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.93.234.129, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abTRU2xFlXQvNewjeI-JjwAAAUs"]
[Sat Mar 14 13:22:09.634490 2026] [autoindex:error] [pid 3912:tid 3938] [client 161.97.112.146:56404] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Mar 14 16:49:19.712375 2026] [:error] [pid 61477:tid 61499] [client 173.239.224.108:23137] [client 173.239.224.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.108, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abUhD6cx6muYfIYRM7CmuAAAAFI"]
[Sat Mar 14 21:12:01.831025 2026] [:error] [pid 61383:tid 61426] [client 103.253.247.44:62032] [client 103.253.247.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.253.247.44, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abVeoS4SAn4TCd4o0dUGVwAAAQo"]
[Sat Mar 14 21:12:17.681638 2026] [:error] [pid 61383:tid 61435] [client 150.107.232.194:34846] [client 150.107.232.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.107.232.194, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abVesS4SAn4TCd4o0dUGdgAAARM"]
[Sun Mar 15 02:34:40.183460 2026] [:error] [pid 20020:tid 20043] [client 176.63.26.128:18621] [client 176.63.26.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.63.26.128, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abWqQEPjaRwagw2fU7gnRAAAAFU"]
[Sun Mar 15 11:26:34.869602 2026] [:error] [pid 50986:tid 51000] [client 86.120.182.36:62368] [client 86.120.182.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.120.182.36, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abYm6iknK4c779bcQqEi0AAAAUs"]
[Sun Mar 15 15:15:24.261287 2026] [autoindex:error] [pid 38536:tid 38568] [client 68.183.93.46:63189] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Mar 15 16:13:20.140017 2026] [:error] [pid 50986:tid 51012] [client 104.234.53.66:50543] [client 104.234.53.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.66, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abZqICknK4c779bcQqF2kwAAAVc"]
[Sun Mar 15 19:10:38.124607 2026] [:error] [pid 45974:tid 45977] [client 154.192.192.165:49292] [client 154.192.192.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.192.192.165, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abaTrhWn4R6u72SegejB2gAAAgE"]
[Sun Mar 15 23:49:50.597558 2026] [:error] [pid 45974:tid 45996] [client 102.164.101.82:63494] [client 102.164.101.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.164.101.82, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abbVHhWn4R6u72SegejrUAAAAhQ"]
[Sun Mar 15 23:50:08.669463 2026] [:error] [pid 45974:tid 45997] [client 104.28.246.112:50875] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/style.php"] [unique_id "abbVMBWn4R6u72SegejrVQAAAhU"]
[Sun Mar 15 23:50:09.089413 2026] [:error] [pid 45974:tid 45995] [client 104.28.246.112:50877] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/style.php"] [unique_id "abbVMRWn4R6u72SegejrVwAAAhM"]
[Sun Mar 15 23:50:09.509494 2026] [:error] [pid 9995:tid 10017] [client 104.28.246.112:50883] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/style.php"] [unique_id "abbVMQa8xkcaSmgTbwiuUQAAARM"]
[Sun Mar 15 23:50:17.170104 2026] [:error] [pid 45801:tid 45817] [client 104.28.246.112:36681] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/style.php"] [unique_id "abbVOYaKHL9CTKoVzTBv6AAAAc4"]
[Sun Mar 15 23:50:18.047992 2026] [:error] [pid 9995:tid 10018] [client 104.28.246.112:36697] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style.php"] [unique_id "abbVOga8xkcaSmgTbwiuYAAAARQ"]
[Sun Mar 15 23:50:18.480786 2026] [:error] [pid 38541:tid 38625] [client 104.28.246.112:36709] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/chosen.php"] [unique_id "abbVOnuOpex8jIO0jt6tSAAAAIw"]
[Sun Mar 15 23:50:20.011963 2026] [:error] [pid 9995:tid 10010] [client 104.28.246.112:31042] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "abbVPAa8xkcaSmgTbwiuYQAAAQw"]
[Mon Mar 16 07:02:28.011824 2026] [:error] [pid 1411:tid 1424] [client 203.188.168.24:48869] [client 203.188.168.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.188.168.24, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abc6hNrCV4sh-le3M-12ggAAAUs"]
[Mon Mar 16 08:25:16.498842 2026] [:error] [pid 62529:tid 62546] [client 103.65.237.124:61571] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "abdN7D84-luOVYZKK0Oj7wAAAMk"]
[Mon Mar 16 08:25:16.855337 2026] [:error] [pid 62529:tid 62550] [client 103.65.237.124:61603] [client 103.65.237.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.vscode/sftp.json"] [unique_id "abdN7D84-luOVYZKK0Oj8AAAAM0"]
[Mon Mar 16 10:36:31.507412 2026] [:error] [pid 62024:tid 62034] [client 179.125.165.137:8134] [client 179.125.165.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.125.165.137, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abdsr4k-5rtjYvjqC_owGgAAAAU"]
[Mon Mar 16 11:05:13.538595 2026] [:error] [pid 62025:tid 62066] [client 173.239.236.149:47563] [client 173.239.236.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "abdzaeimBfLmKh7zLXMCGwAAAEc"]
[Mon Mar 16 11:05:14.698296 2026] [:error] [pid 62025:tid 62077] [client 173.239.236.31:21931] [client 173.239.236.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.239.236.31, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abdzauimBfLmKh7zLXMCRgAAAFI"]
[Mon Mar 16 11:05:16.534863 2026] [:error] [pid 9354:tid 9386] [client 173.239.236.39:35251] [client 173.239.236.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "abdzbHBF0M4d8CifbJ43MAAAAdc"]
[Mon Mar 16 11:05:16.755042 2026] [:error] [pid 62025:tid 62068] [client 173.239.236.142:48027] [client 173.239.236.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "abdzbOimBfLmKh7zLXMCcwAAAEk"]
[Mon Mar 16 11:05:17.004890 2026] [:error] [pid 9400:tid 9438] [client 173.239.236.228:60037] [client 173.239.236.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "abdzbQSHzD8ZM8ddLEnJvQAAAhY"]
[Mon Mar 16 11:05:17.224133 2026] [:error] [pid 9400:tid 9424] [client 173.239.236.215:31705] [client 173.239.236.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/2020/wp-includes/wlwmanifest.xml"] [unique_id "abdzbQSHzD8ZM8ddLEnJygAAAgg"]
[Mon Mar 16 11:05:19.644810 2026] [:error] [pid 62026:tid 62103] [client 173.239.236.3:23755] [client 173.239.236.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "abdzb-8oW52PUIYI2O4LtQAAAJE"]
[Mon Mar 16 11:05:19.865595 2026] [:error] [pid 62510:tid 62527] [client 173.239.236.163:60269] [client 173.239.236.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "abdzbyE33_T9aKpoDdjp5wAAAQ4"]
[Mon Mar 16 11:05:20.085961 2026] [:error] [pid 62026:tid 62104] [client 173.239.236.76:58889] [client 173.239.236.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "abdzcO8oW52PUIYI2O4LuAAAAJI"]
[Mon Mar 16 11:05:20.922416 2026] [:error] [pid 62510:tid 62527] [client 173.239.236.228:20855] [client 173.239.236.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "abdzcCE33_T9aKpoDdjp7QAAAQ4"]
[Mon Mar 16 16:37:56.785032 2026] [:error] [pid 9249:tid 9278] [client 66.249.77.228:44288] [client 66.249.77.228] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.249.77.228, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abfBZAsX15dONR9F2wzWlQAAAVg"]
[Mon Mar 16 16:37:56.890753 2026] [:error] [pid 62119:tid 62122] [client 66.249.77.229:48653] [client 66.249.77.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.249.77.229, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abfBZD-Co-Fir-PyAwfp1gAAAMA"]
[Mon Mar 16 16:37:57.386398 2026] [:error] [pid 62026:tid 62099] [client 66.249.77.229:64264] [client 66.249.77.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.249.77.229, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abfBZe8oW52PUIYI2O5S-gAAAI0"]
[Mon Mar 16 16:37:57.618252 2026] [:error] [pid 62026:tid 62095] [client 66.249.77.229:55550] [client 66.249.77.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.249.77.229, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abfBZe8oW52PUIYI2O5S-wAAAIk"]
[Mon Mar 16 19:54:35.030089 2026] [:error] [pid 35838:tid 35856] [client 64.89.163.113:65127] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "abfvexroTe-x3JLtmo6WSwAAAA4"]
[Mon Mar 16 19:54:35.581249 2026] [:error] [pid 36198:tid 36203] [client 64.89.163.113:51340] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "abfve-lL1GNckmsdWlMz_QAAAQI"]
[Mon Mar 16 19:54:36.199964 2026] [:error] [pid 35838:tid 35863] [client 64.89.163.113:54257] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "abfvfBroTe-x3JLtmo6WeAAAABU"]
[Mon Mar 16 19:54:36.699568 2026] [:error] [pid 35929:tid 35950] [client 64.89.163.113:52287] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "abfvfNW47dGpmA63hwSK5gAAANM"]
[Mon Mar 16 19:54:37.239001 2026] [:error] [pid 1871:tid 1887] [client 64.89.163.113:54200] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "abfvfTinTnZ8uiUPekE7RAAAAY4"]
[Mon Mar 16 21:42:24.243252 2026] [:error] [pid 35838:tid 35862] [client 173.239.224.111:22619] [client 173.239.224.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.111, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abgIwBroTe-x3JLtmo7QSwAAABQ"]
[Mon Mar 16 23:06:13.173856 2026] [:error] [pid 35929:tid 35950] [client 116.197.133.25:52501] [client 116.197.133.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.197.133.25, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abgcZdW47dGpmA63hwTDbgAAANM"]
[Mon Mar 16 23:06:31.591927 2026] [:error] [pid 1871:tid 1881] [client 49.43.129.96:60136] [client 49.43.129.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.129.96, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abgcdzinTnZ8uiUPekGVwQAAAYg"]
[Tue Mar 17 07:38:10.960332 2026] [:error] [pid 22541:tid 22563] [client 31.183.186.120:36724] [client 31.183.186.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.183.186.120, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abiUYqS6JNY1-CTsTA8TzQAAARE"]
[Tue Mar 17 07:40:07.700614 2026] [:error] [pid 46020:tid 46037] [client 180.252.85.188:63360] [client 180.252.85.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.252.85.188, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abiU13-nCcd9BdzGdLcxhAAAAM8"]
[Tue Mar 17 07:56:16.881659 2026] [:error] [pid 45915:tid 45952] [client 185.223.152.138:52097] [client 185.223.152.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.138, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abiYoJh7U84ydzcrcncbLAAAABc"]
[Tue Mar 17 09:09:44.480245 2026] [:error] [pid 45915:tid 45949] [client 136.111.78.136:38320] [client 136.111.78.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "abip2Jh7U84ydzcrcncy8wAAABQ"]
[Tue Mar 17 12:38:28.819782 2026] [:error] [pid 15011:tid 15056] [client 130.12.182.150:39086] [client 130.12.182.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "abjaxMNtgHlAHiPlDyooRQAAAcc"]
[Tue Mar 17 12:38:29.419399 2026] [:error] [pid 15013:tid 15097] [client 130.12.182.150:38210] [client 130.12.182.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "abjaxVZc-p7DonmJmm3ZkwAAAhQ"]
[Tue Mar 17 14:25:32.392329 2026] [:error] [pid 22541:tid 22547] [client 45.249.76.75:55486] [client 45.249.76.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.249.76.75, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abjz3KS6JNY1-CTsTA-stgAAAQE"]
[Tue Mar 17 23:05:07.986908 2026] [:error] [pid 14817:tid 14847] [client 104.28.153.25:38565] [client 104.28.153.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/style.php"] [unique_id "ablto-BWVgTpR3dKOgaKZQAAAVU"]
[Tue Mar 17 23:48:54.148638 2026] [:error] [pid 22541:tid 22564] [client 223.185.43.38:7496] [client 223.185.43.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.43.38, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abl35qS6JNY1-CTsTA9ptAAAARI"]
[Tue Mar 17 23:49:49.189452 2026] [:error] [pid 14817:tid 14832] [client 46.99.20.107:10071] [client 46.99.20.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.99.20.107, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abl4HeBWVgTpR3dKOgaY5AAAAUY"]
[Wed Mar 18 02:02:37.146928 2026] [autoindex:error] [pid 63612:tid 63632] [client 213.199.63.167:55768] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Mar 18 03:14:42.248882 2026] [:error] [pid 40716:tid 41023] [client 20.116.1.191:25280] [client 20.116.1.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.116.1.191, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abmoIhR6i4ByUuhUBAShAAAAAEI"]
[Wed Mar 18 03:14:46.463879 2026] [autoindex:error] [pid 63449:tid 63472] [client 20.116.1.191:24885] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 18 03:15:07.938098 2026] [autoindex:error] [pid 63412:tid 63425] [client 20.116.1.191:24859] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 18 05:48:22.573494 2026] [:error] [pid 13716:tid 13734] [client 34.74.34.88:59110] [client 34.74.34.88] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "abnMJmWKzQVHkZkUHaTzEQAAAVA"]
[Wed Mar 18 06:43:33.126716 2026] [:error] [pid 44966:tid 45041] [client 180.243.7.171:52211] [client 180.243.7.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.243.7.171, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abnZFbHml2_01Zq4-13GawAAAIQ"]
[Wed Mar 18 08:13:19.807834 2026] [:error] [pid 45069:tid 45075] [client 20.2.90.103:40842] [client 20.2.90.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "abnuHzNzUMBULZVa94wfFgAAAMQ"]
[Wed Mar 18 14:11:19.425519 2026] [:error] [pid 42970:tid 42988] [client 202.141.94.188:37255] [client 202.141.94.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.141.94.188, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abpCB45YFUj4vBJI0KQOQAAAANA"]
[Wed Mar 18 14:51:39.870034 2026] [:error] [pid 20667:tid 20687] [client 17.246.19.109:50636] [client 17.246.19.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 17.246.19.109, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abpLe5gyfQyvBhzza_1EqgAAAZI"]
[Wed Mar 18 20:41:32.419455 2026] [:error] [pid 42871:tid 42934] [client 193.36.225.235:55135] [client 193.36.225.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.235, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abqdfGPUS0lM1M9nUaJosAAAAJQ"]
[Wed Mar 18 21:30:03.897681 2026] [:error] [pid 42872:tid 42964] [client 43.245.137.70:49544] [client 43.245.137.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.245.137.70, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abqo2zchM8PQMaMEWJnHrgAAAdY"]
[Wed Mar 18 21:35:01.839722 2026] [:error] [pid 43009:tid 43020] [client 54.208.160.33:48336] [client 54.208.160.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||perthactive.com.au|F|4"] [data "Microsoft URL"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "abqqBX8aUp4Sm6m3nmM-RgAAAQk"]
[Thu Mar 19 02:06:53.981002 2026] [:error] [pid 19196:tid 19323] [client 4.204.253.219:51111] [client 4.204.253.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/1.php"] [unique_id "abrpvbQmdacT_YxarWRcyQAAAAc"]
[Thu Mar 19 02:06:59.587479 2026] [:error] [pid 19196:tid 19335] [client 4.204.253.219:51150] [client 4.204.253.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/1.php"] [unique_id "abrpw7QmdacT_YxarWRc1QAAABM"]
[Thu Mar 19 02:07:04.138039 2026] [:error] [pid 41180:tid 41191] [client 4.204.253.219:51100] [client 4.204.253.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/1.php"] [unique_id "abrpyLuSQ3z2YqXgnycnfAAAAMk"]
[Thu Mar 19 02:07:06.982762 2026] [:error] [pid 19224:tid 19373] [client 4.204.253.219:51105] [client 4.204.253.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/1.php"] [unique_id "abrpyjxUIaHQ6Y3ff51pJQAAAcM"]
[Thu Mar 19 06:31:05.443092 2026] [:error] [pid 31205:tid 31217] [client 31.171.130.24:52987] [client 31.171.130.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.24, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "absnqVu5gZKGrGz5P1H5XAAAAUE"]
[Thu Mar 19 07:45:07.116192 2026] [:error] [pid 31205:tid 31228] [client 91.99.188.14:34042] [client 91.99.188.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.perthactive.com.au"] [uri "/"] [unique_id "abs5A1u5gZKGrGz5P1EaNQAAAUs"]
[Thu Mar 19 07:45:11.131642 2026] [:error] [pid 32226:tid 32228] [client 23.88.43.92:46042] [client 23.88.43.92] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "abs5B7Bb58lgPwqxC6qHoAAAAwA"]
[Thu Mar 19 08:45:15.811254 2026] [:error] [pid 32226:tid 32246] [client 173.239.218.230:24485] [client 173.239.218.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.230, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abtHG7Bb58lgPwqxC6qh3gAAAxI"]
[Thu Mar 19 10:00:27.600440 2026] [autoindex:error] [pid 23988:tid 23991] [client 209.87.169.64:41323] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:00:27.837322 2026] [autoindex:error] [pid 23988:tid 24000] [client 209.87.169.64:41323] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:00:28.221548 2026] [autoindex:error] [pid 23988:tid 24014] [client 209.87.169.64:41323] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:00:28.475462 2026] [autoindex:error] [pid 23988:tid 24013] [client 209.87.169.64:41323] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:00:31.170763 2026] [autoindex:error] [pid 25269:tid 25289] [client 209.87.169.37:49961] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:00:33.908802 2026] [autoindex:error] [pid 25135:tid 25140] [client 209.87.169.235:45833] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:00:34.199444 2026] [autoindex:error] [pid 25135:tid 25140] [client 209.87.169.235:45833] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:00:36.011123 2026] [autoindex:error] [pid 31735:tid 31755] [client 209.87.169.206:28059] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:00:36.868970 2026] [autoindex:error] [pid 23883:tid 23951] [client 209.87.169.234:20673] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:00:37.917994 2026] [autoindex:error] [pid 25135:tid 25148] [client 209.87.169.207:36167] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:00:40.822566 2026] [autoindex:error] [pid 25044:tid 25054] [client 209.87.169.244:44567] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:00:41.052285 2026] [autoindex:error] [pid 25044:tid 25070] [client 209.87.169.244:44567] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:00:41.291382 2026] [autoindex:error] [pid 25044:tid 25049] [client 209.87.169.244:44567] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:00:41.546334 2026] [autoindex:error] [pid 25044:tid 25054] [client 209.87.169.244:44567] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:00:45.686507 2026] [autoindex:error] [pid 25179:tid 25185] [client 209.87.169.51:52499] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 12:54:14.986441 2026] [:error] [pid 25135:tid 25150] [client 154.16.49.101:7180] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "abuBdqKtE0dzgMctjFXtqAAAA00"]
[Thu Mar 19 12:54:15.492314 2026] [:error] [pid 23882:tid 23920] [client 154.16.49.101:7441] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/license.txt"] [unique_id "abuBd7WnClbtbN12M7-UPQAAABI"]
[Thu Mar 19 12:54:15.986105 2026] [:error] [pid 23882:tid 23907] [client 154.16.49.101:7688] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/feed/"] [unique_id "abuBd7WnClbtbN12M7-UdQAAAAU"]
[Thu Mar 19 13:25:59.654717 2026] [:error] [pid 23882:tid 23922] [client 106.219.155.174:10190] [client 106.219.155.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.155.174, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abuI57WnClbtbN12M7-oAQAAABQ"]
[Thu Mar 19 18:11:11.216182 2026] [:error] [pid 11016:tid 11086] [client 82.222.236.100:24580] [client 82.222.236.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.222.236.100, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abvLvxPK94J9G19C6uVHxwAAAQ0"]
[Thu Mar 19 23:10:32.880942 2026] [:error] [pid 1285:tid 1296] [client 98.34.160.189:59853] [client 98.34.160.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.34.160.189, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abwR6FE95r3zR75X1Hpq8wAAAgk"]
[Fri Mar 20 01:20:24.719466 2026] [:error] [pid 46125:tid 46247] [client 178.128.102.180:54379] [client 178.128.102.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.perthactive.com.au"] [uri "/wp-includes/speculative8.php"] [unique_id "abwwWGgN4lI6NHeckY5djQAAAJM"]
[Fri Mar 20 01:20:25.085468 2026] [:error] [pid 11258:tid 11271] [client 178.128.102.180:54932] [client 178.128.102.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abwwWZPHb95f6xzHJOcTtwAAAMs"]
[Fri Mar 20 01:20:25.919870 2026] [:error] [pid 46124:tid 46204] [client 178.128.102.180:55763] [client 178.128.102.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.perthactive.com.au"] [uri "/wp-includes/speculative8.php"] [unique_id "abwwWUzMrlLOY6zyCjJ4dQAAAFg"]
[Fri Mar 20 01:20:26.389698 2026] [:error] [pid 46124:tid 46184] [client 178.128.102.180:56369] [client 178.128.102.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abwwWkzMrlLOY6zyCjJ4dwAAAEQ"]
[Fri Mar 20 04:51:23.447211 2026] [autoindex:error] [pid 58126:tid 58193] [client 40.74.65.33:3374] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 04:51:27.060464 2026] [autoindex:error] [pid 58230:tid 58234] [client 40.74.65.33:3378] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 04:51:32.380409 2026] [autoindex:error] [pid 58126:tid 58173] [client 40.74.65.33:6685] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 04:51:35.357960 2026] [autoindex:error] [pid 58230:tid 58255] [client 40.74.65.33:3133] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 04:51:36.015555 2026] [autoindex:error] [pid 58230:tid 58244] [client 40.74.65.33:6695] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 04:51:36.140962 2026] [autoindex:error] [pid 58230:tid 58239] [client 40.74.65.33:6695] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 04:51:36.267520 2026] [autoindex:error] [pid 58230:tid 58257] [client 40.74.65.33:6695] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 04:51:39.100570 2026] [autoindex:error] [pid 58126:tid 58193] [client 40.74.65.33:5681] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 04:51:39.249683 2026] [autoindex:error] [pid 58126:tid 58189] [client 40.74.65.33:5681] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 04:59:24.919721 2026] [:error] [pid 58127:tid 58214] [client 31.171.130.123:32943] [client 31.171.130.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.123, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abxjrLQ_HbYy8C6I_EHllgAAAI8"]
[Fri Mar 20 06:02:49.161703 2026] [:error] [pid 55301:tid 55392] [client 190.56.126.22:54167] [client 190.56.126.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.56.126.22, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abxyicKP1x4sgmjd3xRGIgAAApI"]
[Fri Mar 20 06:05:30.720769 2026] [:error] [pid 55239:tid 55285] [client 186.83.180.22:55702] [client 186.83.180.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.83.180.22, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "abxzKqycM6mGWSmcyoLhkwAAAcw"]
[Fri Mar 20 14:30:13.883175 2026] [:error] [pid 49081:tid 49136] [client 185.198.240.40:40157] [client 185.198.240.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.40, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "abzpdRo1LBAUhfhYPR3DfAAAARU"]
[Fri Mar 20 16:04:59.109728 2026] [autoindex:error] [pid 49081:tid 49133] [client 173.249.30.252:65046] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Mar 20 18:34:03.422014 2026] [:error] [pid 49082:tid 49146] [client 43.248.59.245:62100] [client 43.248.59.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.248.59.245, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ab0im6pllYJI1LUIdL-nDwAAAUQ"]
[Fri Mar 20 18:34:18.944257 2026] [:error] [pid 49170:tid 49193] [client 136.158.37.22:31476] [client 136.158.37.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.158.37.22, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ab0iqs-c8ctLVDCqUJVf6QAAABM"]
[Fri Mar 20 20:13:33.660475 2026] [:error] [pid 38219:tid 38242] [client 216.24.212.11:51183] [client 216.24.212.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.212.11, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ab057XLdNs2F_zXG7H_7ogAAAYw"]
[Fri Mar 20 21:19:49.857329 2026] [:error] [pid 38219:tid 38248] [client 178.171.63.127:26779] [client 178.171.63.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about"] [unique_id "ab1JdXLdNs2F_zXG7H8DRQAAAZI"], referer: https://perthactive.com.au/about
[Fri Mar 20 21:19:53.219420 2026] [:error] [pid 38305:tid 38336] [client 175.110.85.244:40241] [client 175.110.85.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about-us"] [unique_id "ab1JeXguiB3cZkKG6iI-qwAAAdg"], referer: https://perthactive.com.au/about-us
[Fri Mar 20 21:19:53.948094 2026] [:error] [pid 49082:tid 49150] [client 178.92.82.167:26153] [client 178.92.82.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about"] [unique_id "ab1JeapllYJI1LUIdL_RLgAAAUg"], referer: https://perthactive.com.au/about
[Fri Mar 20 21:19:55.311631 2026] [:error] [pid 49170:tid 49175] [client 91.108.231.96:27417] [client 91.108.231.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about-us"] [unique_id "ab1Je8-c8ctLVDCqUJWSrAAAAAE"], referer: https://perthactive.com.au/about-us
[Fri Mar 20 21:19:56.651143 2026] [:error] [pid 49081:tid 49116] [client 188.191.106.48:39203] [client 188.191.106.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about"] [unique_id "ab1JfBo1LBAUhfhYPR2SjwAAAQE"], referer: https://perthactive.com.au/about
[Fri Mar 20 21:19:57.971721 2026] [:error] [pid 38305:tid 38332] [client 185.89.107.187:48329] [client 185.89.107.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about"] [unique_id "ab1JfXguiB3cZkKG6iI-sgAAAdQ"], referer: https://perthactive.com.au/about
[Fri Mar 20 21:19:58.069276 2026] [:error] [pid 49082:tid 49165] [client 82.38.56.228:55933] [client 82.38.56.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about-us"] [unique_id "ab1JfqpllYJI1LUIdL_RMwAAAVc"], referer: https://perthactive.com.au/about-us
[Fri Mar 20 21:19:59.084906 2026] [:error] [pid 38378:tid 38390] [client 200.234.162.129:57845] [client 200.234.162.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about-us"] [unique_id "ab1Jf1Kb3npPsu9Iib17_QAAAgg"], referer: https://perthactive.com.au/about-us
[Fri Mar 20 21:19:59.181011 2026] [:error] [pid 49080:tid 49096] [client 216.189.109.67:64977] [client 216.189.109.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about"] [unique_id "ab1Jf4k5CHi4V0A3ttgUJgAAAEo"], referer: https://perthactive.com.au/about
[Fri Mar 20 21:20:00.118653 2026] [:error] [pid 49170:tid 49198] [client 207.170.175.14:47631] [client 207.170.175.14] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about"] [unique_id "ab1JgM-c8ctLVDCqUJWSsQAAABg"], referer: https://perthactive.com.au/about
[Fri Mar 20 21:20:00.279526 2026] [:error] [pid 49082:tid 49144] [client 69.51.18.216:53173] [client 69.51.18.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about-us"] [unique_id "ab1JgKpllYJI1LUIdL_ROwAAAUI"], referer: https://perthactive.com.au/about-us
[Fri Mar 20 21:20:01.420514 2026] [:error] [pid 38378:tid 38397] [client 82.38.59.244:48299] [client 82.38.59.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about-us"] [unique_id "ab1JgVKb3npPsu9Iib17_wAAAg8"], referer: https://perthactive.com.au/about-us
[Fri Mar 20 21:20:03.976453 2026] [:error] [pid 49170:tid 49194] [client 178.171.50.247:48251] [client 178.171.50.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about"] [unique_id "ab1Jg8-c8ctLVDCqUJWSugAAABQ"], referer: https://perthactive.com.au/about
[Fri Mar 20 21:20:05.189652 2026] [:error] [pid 38305:tid 38316] [client 37.19.67.64:63581] [client 37.19.67.64] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about-us"] [unique_id "ab1JhXguiB3cZkKG6iI-wQAAAcQ"], referer: https://perthactive.com.au/about-us
[Fri Mar 20 21:20:07.884193 2026] [:error] [pid 49170:tid 49198] [client 185.55.4.234:30899] [client 185.55.4.234] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about"] [unique_id "ab1Jh8-c8ctLVDCqUJWSyQAAABg"], referer: https://perthactive.com.au/about
[Fri Mar 20 21:20:11.808576 2026] [:error] [pid 38219:tid 38237] [client 194.53.140.20:50853] [client 194.53.140.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about"] [unique_id "ab1Ji3LdNs2F_zXG7H8DVgAAAYc"], referer: https://perthactive.com.au/about
[Fri Mar 20 21:20:14.016032 2026] [:error] [pid 38219:tid 38230] [client 216.189.97.110:30641] [client 216.189.97.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about"] [unique_id "ab1JjnLdNs2F_zXG7H8DYAAAAYA"], referer: https://perthactive.com.au/about
[Fri Mar 20 21:20:16.067251 2026] [:error] [pid 38305:tid 38328] [client 206.232.2.184:38751] [client 206.232.2.184] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/about"] [unique_id "ab1JkHguiB3cZkKG6iI-xQAAAdA"], referer: https://perthactive.com.au/about
[Fri Mar 20 21:41:59.121108 2026] [:error] [pid 38219:tid 38239] [client 79.127.164.175:61447] [client 79.127.164.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "ab1Op3LdNs2F_zXG7H8GCgAAAYk"]
[Sat Mar 21 00:30:22.980168 2026] [:error] [pid 62754:tid 62823] [client 45.132.184.129:41413] [client 45.132.184.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.184.129, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ab12HhwXN_jHGJ5L7yE-OQAAAAg"]
[Sat Mar 21 01:03:41.652430 2026] [:error] [pid 62754:tid 62833] [client 95.91.236.25:51565] [client 95.91.236.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.91.236.25, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ab197RwXN_jHGJ5L7yFTJgAAABI"]
[Sat Mar 21 01:09:01.317342 2026] [:error] [pid 62480:tid 62558] [client 185.223.152.198:36199] [client 185.223.152.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.198, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ab1_Lbq1lu6xCJtkVarlngAAAVQ"]
[Sat Mar 21 01:42:18.398432 2026] [:error] [pid 62479:tid 62530] [client 147.93.141.35:59161] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/style.php"] [unique_id "ab2G-vKZ7MVNG8qirU9jDwAAARM"]
[Sat Mar 21 01:42:18.825394 2026] [:error] [pid 62480:tid 62562] [client 147.93.141.35:59174] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/style.php"] [unique_id "ab2G-rq1lu6xCJtkVar0UwAAAVg"]
[Sat Mar 21 01:42:19.212113 2026] [:error] [pid 62479:tid 62515] [client 147.93.141.35:59189] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/style.php"] [unique_id "ab2G-_KZ7MVNG8qirU9jEQAAAQQ"]
[Sat Mar 21 01:42:19.614643 2026] [:error] [pid 62480:tid 62548] [client 147.93.141.35:59206] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/style.php"] [unique_id "ab2G-7q1lu6xCJtkVar0VgAAAUo"]
[Sat Mar 21 01:42:19.996198 2026] [:error] [pid 62476:tid 62501] [client 147.93.141.35:59225] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style.php"] [unique_id "ab2G-2BL9BQ4RM1FKIB78QAAAFI"]
[Sat Mar 21 01:42:20.378454 2026] [:error] [pid 62480:tid 62551] [client 147.93.141.35:59235] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/chosen.php"] [unique_id "ab2G_Lq1lu6xCJtkVar0WAAAAU0"]
[Sat Mar 21 01:42:20.761377 2026] [:error] [pid 62479:tid 62523] [client 147.93.141.35:59249] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "ab2G_PKZ7MVNG8qirU9jEwAAAQw"]
[Sat Mar 21 01:42:21.146702 2026] [:error] [pid 62480:tid 62552] [client 147.93.141.35:59266] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/flower.php"] [unique_id "ab2G_bq1lu6xCJtkVar0WgAAAU4"]
[Sat Mar 21 01:42:21.617017 2026] [:error] [pid 62479:tid 62514] [client 147.93.141.35:59287] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/gifclass.php"] [unique_id "ab2G_fKZ7MVNG8qirU9jFQAAAQM"]
[Sat Mar 21 01:42:22.043918 2026] [:error] [pid 62476:tid 62498] [client 147.93.141.35:59321] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bless.php"] [unique_id "ab2G_mBL9BQ4RM1FKIB7-gAAAE8"]
[Sat Mar 21 01:42:22.428292 2026] [:error] [pid 62479:tid 62533] [client 147.93.141.35:59361] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/class-t.api.php"] [unique_id "ab2G_vKZ7MVNG8qirU9jGQAAARY"]
[Sat Mar 21 01:42:23.021597 2026] [:error] [pid 62479:tid 62528] [client 147.93.141.35:59392] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/blurbs.php"] [unique_id "ab2G__KZ7MVNG8qirU9jGwAAARE"]
[Sat Mar 21 01:42:23.444847 2026] [:error] [pid 62754:tid 62816] [client 147.93.141.35:59426] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/akcc.php"] [unique_id "ab2G_xwXN_jHGJ5L7yFr6wAAAAE"]
[Sat Mar 21 01:42:23.829512 2026] [:error] [pid 62479:tid 62525] [client 147.93.141.35:59459] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/abcd.php"] [unique_id "ab2G__KZ7MVNG8qirU9jHQAAAQ4"]
[Sat Mar 21 01:42:24.219013 2026] [:error] [pid 62480:tid 62538] [client 147.93.141.35:53395] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/shelp.php"] [unique_id "ab2HALq1lu6xCJtkVar0ZAAAAUA"]
[Sat Mar 21 01:42:24.603204 2026] [:error] [pid 62480:tid 62539] [client 147.93.141.35:53429] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cord.php"] [unique_id "ab2HALq1lu6xCJtkVar0ZwAAAUE"]
[Sat Mar 21 01:42:25.032126 2026] [:error] [pid 62480:tid 62556] [client 147.93.141.35:53454] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/dex.php"] [unique_id "ab2HAbq1lu6xCJtkVar0agAAAVI"]
[Sat Mar 21 01:42:25.421015 2026] [:error] [pid 62479:tid 62516] [client 147.93.141.35:53494] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "ab2HAfKZ7MVNG8qirU9jHgAAAQU"]
[Sat Mar 21 01:42:25.851491 2026] [:error] [pid 62476:tid 62496] [client 147.93.141.35:62652] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/file2.php"] [unique_id "ab2HAWBL9BQ4RM1FKIB7_QAAAE0"]
[Sat Mar 21 01:42:26.242849 2026] [:error] [pid 62476:tid 62505] [client 147.93.141.35:62686] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/zwso.php"] [unique_id "ab2HAmBL9BQ4RM1FKIB7_wAAAFY"]
[Sat Mar 21 01:42:26.627401 2026] [:error] [pid 62754:tid 62815] [client 147.93.141.35:62713] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/zwso.php"] [unique_id "ab2HAhwXN_jHGJ5L7yFr8QAAAAA"]
[Sat Mar 21 01:42:27.012081 2026] [:error] [pid 62754:tid 62827] [client 147.93.141.35:62744] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "ab2HAxwXN_jHGJ5L7yFr8wAAAAw"]
[Sat Mar 21 01:42:27.399704 2026] [:error] [pid 62754:tid 62816] [client 147.93.141.35:62775] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bolt.php"] [unique_id "ab2HAxwXN_jHGJ5L7yFr9AAAAAE"]
[Sat Mar 21 01:42:28.073757 2026] [:error] [pid 62480:tid 62538] [client 147.93.141.35:62823] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/shlo.php"] [unique_id "ab2HBLq1lu6xCJtkVar0bgAAAUA"]
[Sat Mar 21 01:42:28.460084 2026] [:error] [pid 62479:tid 62512] [client 147.93.141.35:51382] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/133.php"] [unique_id "ab2HBPKZ7MVNG8qirU9jIQAAAQE"]
[Sat Mar 21 01:42:28.847321 2026] [:error] [pid 62754:tid 62821] [client 147.93.141.35:51432] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ahax.php"] [unique_id "ab2HBBwXN_jHGJ5L7yFr-QAAAAY"]
[Sat Mar 21 01:42:29.235873 2026] [:error] [pid 62480:tid 62553] [client 147.93.141.35:51474] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/php8.php"] [unique_id "ab2HBbq1lu6xCJtkVar0cAAAAU8"]
[Sat Mar 21 01:42:29.663983 2026] [:error] [pid 62476:tid 62502] [client 147.93.141.35:53965] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/lufix1.php"] [unique_id "ab2HBWBL9BQ4RM1FKIB8AwAAAFM"]
[Sat Mar 21 01:42:30.098350 2026] [:error] [pid 62479:tid 62511] [client 147.93.141.35:54021] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/witmm.php"] [unique_id "ab2HBvKZ7MVNG8qirU9jKAAAAQA"]
[Sat Mar 21 01:42:30.616988 2026] [:error] [pid 62480:tid 62559] [client 147.93.141.35:54061] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "ab2HBrq1lu6xCJtkVar0dAAAAVU"]
[Sat Mar 21 01:42:31.041125 2026] [:error] [pid 62480:tid 62551] [client 147.93.141.35:54091] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "ab2HB7q1lu6xCJtkVar0dwAAAU0"]
[Sat Mar 21 01:42:31.540418 2026] [:error] [pid 62479:tid 62513] [client 147.93.141.35:54121] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/index.php"] [unique_id "ab2HB_KZ7MVNG8qirU9jKgAAAQI"]
[Sat Mar 21 01:42:32.047937 2026] [:error] [pid 62754:tid 62827] [client 147.93.141.35:54147] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "ab2HCBwXN_jHGJ5L7yFr_QAAAAw"]
[Sat Mar 21 01:42:32.442431 2026] [:error] [pid 62754:tid 62826] [client 147.93.141.35:54179] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/222.php"] [unique_id "ab2HCBwXN_jHGJ5L7yFr_wAAAAs"]
[Sat Mar 21 01:42:33.201714 2026] [:error] [pid 62479:tid 62530] [client 147.93.141.35:52350] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/files.php"] [unique_id "ab2HCfKZ7MVNG8qirU9jLQAAARM"]
[Sat Mar 21 01:42:33.586997 2026] [:error] [pid 62754:tid 62828] [client 147.93.141.35:52389] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-editor.php"] [unique_id "ab2HCRwXN_jHGJ5L7yFsBAAAAA0"]
[Sat Mar 21 01:42:34.059775 2026] [:error] [pid 62480:tid 62556] [client 147.93.141.35:52422] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/txets.php"] [unique_id "ab2HCrq1lu6xCJtkVar0fQAAAVI"]
[Sat Mar 21 01:42:34.566438 2026] [:error] [pid 62476:tid 62489] [client 147.93.141.35:52241] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/txets.php"] [unique_id "ab2HCmBL9BQ4RM1FKIB8BAAAAEY"]
[Sat Mar 21 01:42:35.156675 2026] [:error] [pid 62480:tid 62560] [client 147.93.141.35:52276] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/txets.php"] [unique_id "ab2HC7q1lu6xCJtkVar0gAAAAVY"]
[Sat Mar 21 01:42:35.558551 2026] [:error] [pid 62754:tid 62838] [client 147.93.141.35:64452] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/postnews.php"] [unique_id "ab2HCxwXN_jHGJ5L7yFsCQAAABc"]
[Sat Mar 21 01:42:35.942645 2026] [:error] [pid 62754:tid 62825] [client 147.93.141.35:64492] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/postnews.php"] [unique_id "ab2HCxwXN_jHGJ5L7yFsCgAAAAo"]
[Sat Mar 21 01:42:36.328087 2026] [:error] [pid 62479:tid 62525] [client 147.93.141.35:64530] [client 147.93.141.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/postnews.php"] [unique_id "ab2HDPKZ7MVNG8qirU9jMAAAAQ4"]
[Sat Mar 21 10:12:50.978225 2026] [:error] [pid 33678:tid 33695] [client 80.182.228.133:58689] [client 80.182.228.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.182.228.133, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ab3-ojuClB_om73sXhcvfwAAAg8"]
[Sat Mar 21 14:10:22.605410 2026] [:error] [pid 1489:tid 1523] [client 49.37.41.85:49403] [client 49.37.41.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.41.85, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ab42TlRvnvBO_DG9kxuNRgAAABM"]
[Sat Mar 21 14:10:53.821711 2026] [:error] [pid 42886:tid 42898] [client 217.165.159.190:59936] [client 217.165.159.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.165.159.190, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ab42bV452dC6nbNWav0uVQAAAwo"]
[Sun Mar 22 04:24:37.901167 2026] [:error] [pid 51362:tid 51423] [client 52.138.39.105:56733] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/term.php"] [unique_id "ab7-hcOwPm3DXzTDjUeThwAAAFY"]
[Sun Mar 22 04:24:38.728487 2026] [:error] [pid 51362:tid 51422] [client 52.138.39.105:19738] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/term.php"] [unique_id "ab7-hsOwPm3DXzTDjUeTigAAAFU"]
[Sun Mar 22 04:24:39.644866 2026] [:error] [pid 51362:tid 51415] [client 52.138.39.105:20119] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/term.php"] [unique_id "ab7-h8OwPm3DXzTDjUeTjgAAAE4"]
[Sun Mar 22 04:24:40.485967 2026] [:error] [pid 51468:tid 51478] [client 52.138.39.105:44327] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/term.php"] [unique_id "ab7-iE2TppSvA8W5CBRaPgAAAMI"]
[Sun Mar 22 09:26:57.032027 2026] [:error] [pid 40039:tid 40052] [client 186.22.17.113:30787] [client 186.22.17.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.22.17.113, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ab9FYR3aDgUJfBYishmF6gAAAQs"]
[Sun Mar 22 09:27:00.641061 2026] [:error] [pid 40039:tid 40049] [client 177.190.179.54:13939] [client 177.190.179.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.190.179.54, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ab9FZB3aDgUJfBYishmF8QAAAQg"]
[Sun Mar 22 10:13:34.257987 2026] [autoindex:error] [pid 40039:tid 40063] [client 89.117.54.137:64240] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Mar 22 19:35:59.738114 2026] [:error] [pid 51363:tid 51434] [client 20.102.53.32:53921] [client 20.102.53.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.102.53.32, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ab_UH1wa9x6OCTRkhl2dcAAAAIY"]
[Sun Mar 22 19:36:16.664441 2026] [autoindex:error] [pid 51363:tid 51453] [client 20.102.53.32:52260] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 19:36:41.685873 2026] [autoindex:error] [pid 30166:tid 30199] [client 20.102.53.32:1658] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 19:36:43.943338 2026] [autoindex:error] [pid 30166:tid 30174] [client 20.102.53.32:1510] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 19:36:59.691468 2026] [:error] [pid 51468:tid 51482] [client 20.102.53.32:48591] [client 20.102.53.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ab_UW02TppSvA8W5CBRH-AAAAMY"]
[Sun Mar 22 19:37:05.360332 2026] [autoindex:error] [pid 30166:tid 30189] [client 20.102.53.32:51090] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 19:37:19.058578 2026] [:error] [pid 51362:tid 51402] [client 20.102.53.32:51084] [client 20.102.53.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "ab_Ub8OwPm3DXzTDjUetEgAAAEI"]
[Sun Mar 22 19:37:21.130672 2026] [autoindex:error] [pid 51362:tid 51424] [client 20.102.53.32:56681] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 19:37:22.667324 2026] [autoindex:error] [pid 30166:tid 30171] [client 20.102.53.32:51797] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/block/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 19:37:24.468870 2026] [:error] [pid 40039:tid 40060] [client 20.102.53.32:56668] [client 20.102.53.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "ab_UdB3aDgUJfBYishmq_QAAARM"]
[Sun Mar 22 19:38:15.901297 2026] [:error] [pid 30166:tid 30188] [client 20.102.53.32:1380] [client 20.102.53.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sf.php"] [unique_id "ab_Up7m4_26jKMD0zy3atAAAAU0"]
[Sun Mar 22 19:38:17.388197 2026] [:error] [pid 30166:tid 30187] [client 20.102.53.32:1174] [client 20.102.53.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sf.php"] [unique_id "ab_Uqbm4_26jKMD0zy3auQAAAUw"]
[Sun Mar 22 19:38:20.092396 2026] [:error] [pid 51362:tid 51415] [client 20.102.53.32:1393] [client 20.102.53.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sf.php"] [unique_id "ab_UrMOwPm3DXzTDjUetmQAAAE4"]
[Sun Mar 22 20:08:47.100052 2026] [:error] [pid 51363:tid 51444] [client 51.107.72.110:6435] [client 51.107.72.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/app.php"] [unique_id "ab_bz1wa9x6OCTRkhl2yrwAAAI8"]
[Mon Mar 23 02:24:29.490558 2026] [:error] [pid 27776:tid 27858] [client 20.115.24.110:51737] [client 20.115.24.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "acAz3Y3Eaq7IZ5L-4XVioAAAAQs"]
[Mon Mar 23 03:02:09.805913 2026] [:error] [pid 20587:tid 20644] [client 20.220.223.1:36849] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "acA8sYByf8r3QAk4VXP_vgAAAIE"]
[Mon Mar 23 03:02:32.954879 2026] [:error] [pid 27776:tid 27872] [client 20.220.223.1:36839] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "acA8yI3Eaq7IZ5L-4XV2ngAAARg"]
[Mon Mar 23 03:02:33.957112 2026] [:error] [pid 27776:tid 27860] [client 20.220.223.1:36827] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "acA8yY3Eaq7IZ5L-4XV2oQAAAQ0"]
[Mon Mar 23 03:02:35.841949 2026] [:error] [pid 20574:tid 20604] [client 20.220.223.1:36850] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "acA8y9dMXEnEZrwyzJkdwQAAAA8"]
[Mon Mar 23 03:02:37.385851 2026] [:error] [pid 20574:tid 20602] [client 20.220.223.1:36837] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "acA8zddMXEnEZrwyzJkdxAAAAA0"]
[Mon Mar 23 03:02:39.578003 2026] [proxy_fcgi:error] [pid 20574:tid 20606] [client 20.220.223.1:36743] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 03:02:59.979448 2026] [:error] [pid 20856:tid 20927] [client 20.220.223.1:36824] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "acA848xFtXFVNE-X2-K1KAAAAMg"]
[Mon Mar 23 03:03:00.503622 2026] [:error] [pid 27776:tid 27860] [client 20.220.223.1:36770] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/radio.php"] [unique_id "acA85I3Eaq7IZ5L-4XV23gAAAQ0"]
[Mon Mar 23 03:03:00.931300 2026] [:error] [pid 27776:tid 27867] [client 20.220.223.1:36805] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/radio.php"] [unique_id "acA85I3Eaq7IZ5L-4XV23wAAARQ"]
[Mon Mar 23 03:03:01.395184 2026] [:error] [pid 27776:tid 27862] [client 20.220.223.1:36836] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/radio.php"] [unique_id "acA85Y3Eaq7IZ5L-4XV24wAAAQ8"]
[Mon Mar 23 03:03:01.856135 2026] [:error] [pid 20856:tid 20932] [client 20.220.223.1:36742] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/radio.php"] [unique_id "acA85cxFtXFVNE-X2-K1KwAAAM0"]
[Mon Mar 23 03:03:02.273998 2026] [:error] [pid 27776:tid 27863] [client 20.220.223.1:36689] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "acA85o3Eaq7IZ5L-4XV25wAAARA"]
[Mon Mar 23 03:03:02.835117 2026] [:error] [pid 27776:tid 27853] [client 20.220.223.1:36822] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "acA85o3Eaq7IZ5L-4XV26gAAAQc"]
[Mon Mar 23 03:03:03.266350 2026] [:error] [pid 27776:tid 27861] [client 20.220.223.1:36626] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "acA8543Eaq7IZ5L-4XV27gAAAQ4"]
[Mon Mar 23 03:03:03.823686 2026] [:error] [pid 27776:tid 27859] [client 20.220.223.1:36688] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "acA8543Eaq7IZ5L-4XV28gAAAQw"]
[Mon Mar 23 03:03:04.283749 2026] [:error] [pid 20584:tid 20631] [client 20.220.223.1:36715] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/admin.php"] [unique_id "acA86CWzr-bD_t6AP_TYlAAAAE8"]
[Mon Mar 23 03:03:04.825206 2026] [:error] [pid 20574:tid 20599] [client 20.220.223.1:36710] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/admin.php"] [unique_id "acA86NdMXEnEZrwyzJkd8gAAAAo"]
[Mon Mar 23 03:03:05.265745 2026] [:error] [pid 20856:tid 20931] [client 20.220.223.1:36675] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/admin.php"] [unique_id "acA86cxFtXFVNE-X2-K1MgAAAMw"]
[Mon Mar 23 03:03:05.686957 2026] [:error] [pid 20856:tid 20933] [client 20.220.223.1:36684] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/admin.php"] [unique_id "acA86cxFtXFVNE-X2-K1NAAAAM4"]
[Mon Mar 23 03:03:06.133849 2026] [:error] [pid 20587:tid 20667] [client 20.220.223.1:36815] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/admin.php"] [unique_id "acA86oByf8r3QAk4VXP_-QAAAJg"]
[Mon Mar 23 03:03:06.582785 2026] [:error] [pid 20574:tid 20595] [client 20.220.223.1:36753] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/admin.php"] [unique_id "acA86tdMXEnEZrwyzJkd9wAAAAY"]
[Mon Mar 23 03:03:07.020323 2026] [:error] [pid 20587:tid 20664] [client 20.220.223.1:36611] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/admin.php"] [unique_id "acA864Byf8r3QAk4VXP_-wAAAJU"]
[Mon Mar 23 03:03:07.452679 2026] [:error] [pid 20574:tid 20593] [client 20.220.223.1:36776] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/admin.php"] [unique_id "acA869dMXEnEZrwyzJkd-wAAAAQ"]
[Mon Mar 23 03:03:07.899854 2026] [:error] [pid 20574:tid 20591] [client 20.220.223.1:36687] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "acA869dMXEnEZrwyzJkd_gAAAAI"]
[Mon Mar 23 03:03:08.355416 2026] [:error] [pid 20587:tid 20650] [client 20.220.223.1:36852] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "acA87IByf8r3QAk4VXMAAQAAAIc"]
[Mon Mar 23 03:03:08.810208 2026] [:error] [pid 20584:tid 20632] [client 20.220.223.1:36672] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "acA87CWzr-bD_t6AP_TYnQAAAFA"]
[Mon Mar 23 03:03:09.223022 2026] [:error] [pid 20574:tid 20612] [client 20.220.223.1:36691] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "acA87ddMXEnEZrwyzJkeAgAAABc"]
[Mon Mar 23 03:03:09.655040 2026] [:error] [pid 20584:tid 20634] [client 20.220.223.1:36766] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "acA87SWzr-bD_t6AP_TYnwAAAFI"]
[Mon Mar 23 03:03:10.088202 2026] [:error] [pid 20856:tid 20932] [client 20.220.223.1:36829] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "acA87sxFtXFVNE-X2-K1OgAAAM0"]
[Mon Mar 23 03:03:10.788299 2026] [:error] [pid 20574:tid 20597] [client 20.220.223.1:36746] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "acA87tdMXEnEZrwyzJkeCQAAAAg"]
[Mon Mar 23 03:03:11.881715 2026] [:error] [pid 20574:tid 20608] [client 20.220.223.1:36861] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "acA879dMXEnEZrwyzJkeDAAAABM"]
[Mon Mar 23 03:03:12.297503 2026] [:error] [pid 20574:tid 20596] [client 20.220.223.1:36705] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/log.php"] [unique_id "acA88NdMXEnEZrwyzJkeDgAAAAc"]
[Mon Mar 23 03:03:12.716497 2026] [:error] [pid 20574:tid 20613] [client 20.220.223.1:36859] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/log.php"] [unique_id "acA88NdMXEnEZrwyzJkeEgAAABg"]
[Mon Mar 23 03:03:13.170582 2026] [:error] [pid 27776:tid 27859] [client 20.220.223.1:36617] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/log.php"] [unique_id "acA88Y3Eaq7IZ5L-4XV2_gAAAQw"]
[Mon Mar 23 03:03:13.658935 2026] [:error] [pid 20574:tid 20597] [client 20.220.223.1:36679] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/log.php"] [unique_id "acA88ddMXEnEZrwyzJkeFwAAAAg"]
[Mon Mar 23 03:03:14.141005 2026] [:error] [pid 20856:tid 20931] [client 20.220.223.1:36808] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class.php"] [unique_id "acA88sxFtXFVNE-X2-K1QgAAAMw"]
[Mon Mar 23 03:03:14.622437 2026] [:error] [pid 20584:tid 20640] [client 20.220.223.1:36799] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class.php"] [unique_id "acA88iWzr-bD_t6AP_TYowAAAFg"]
[Mon Mar 23 03:03:15.671886 2026] [:error] [pid 20584:tid 20628] [client 20.220.223.1:36782] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class.php"] [unique_id "acA88yWzr-bD_t6AP_TYpwAAAEw"]
[Mon Mar 23 03:03:16.484879 2026] [:error] [pid 20574:tid 20594] [client 20.220.223.1:36721] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class.php"] [unique_id "acA89NdMXEnEZrwyzJkeIgAAAAU"]
[Mon Mar 23 03:03:17.454336 2026] [:error] [pid 20574:tid 20606] [client 20.220.223.1:36724] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bless5.php"] [unique_id "acA89ddMXEnEZrwyzJkeJAAAABE"]
[Mon Mar 23 03:03:19.086369 2026] [:error] [pid 20574:tid 20609] [client 20.220.223.1:36731] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bless5.php"] [unique_id "acA899dMXEnEZrwyzJkeKAAAABQ"]
[Mon Mar 23 03:03:19.955523 2026] [:error] [pid 27776:tid 27850] [client 20.220.223.1:36694] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bless5.php"] [unique_id "acA8943Eaq7IZ5L-4XV3CgAAAQQ"]
[Mon Mar 23 03:03:20.380806 2026] [:error] [pid 20856:tid 20928] [client 20.220.223.1:36828] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bless5.php"] [unique_id "acA8-MxFtXFVNE-X2-K1UQAAAMk"]
[Mon Mar 23 03:03:20.876511 2026] [:error] [pid 27776:tid 27871] [client 20.220.223.1:36676] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "acA8-I3Eaq7IZ5L-4XV3DAAAARc"]
[Mon Mar 23 03:03:21.576713 2026] [:error] [pid 27776:tid 27868] [client 20.220.223.1:36833] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "acA8-Y3Eaq7IZ5L-4XV3DQAAARU"]
[Mon Mar 23 03:03:22.160269 2026] [:error] [pid 27776:tid 27846] [client 20.220.223.1:36783] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "acA8-o3Eaq7IZ5L-4XV3EAAAAQA"]
[Mon Mar 23 03:03:22.586594 2026] [:error] [pid 27776:tid 27865] [client 20.220.223.1:36674] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "acA8-o3Eaq7IZ5L-4XV3EwAAARI"]
[Mon Mar 23 03:03:23.051989 2026] [:error] [pid 20856:tid 20922] [client 20.220.223.1:36775] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "acA8-8xFtXFVNE-X2-K1WQAAAMM"]
[Mon Mar 23 03:03:23.471590 2026] [:error] [pid 20574:tid 20607] [client 20.220.223.1:36699] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "acA8-9dMXEnEZrwyzJkeKwAAABI"]
[Mon Mar 23 03:03:23.924573 2026] [:error] [pid 20856:tid 20933] [client 20.220.223.1:36768] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/f35.php"] [unique_id "acA8-8xFtXFVNE-X2-K1YQAAAM4"]
[Mon Mar 23 03:03:24.351177 2026] [:error] [pid 20856:tid 20927] [client 20.220.223.1:36761] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/f35.php"] [unique_id "acA8_MxFtXFVNE-X2-K1ZgAAAMg"]
[Mon Mar 23 03:03:24.810919 2026] [:error] [pid 20856:tid 20935] [client 20.220.223.1:36818] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/f35.php"] [unique_id "acA8_MxFtXFVNE-X2-K1aQAAANA"]
[Mon Mar 23 03:03:25.228903 2026] [:error] [pid 20574:tid 20611] [client 20.220.223.1:36683] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/f35.php"] [unique_id "acA8_ddMXEnEZrwyzJkeLQAAABY"]
[Mon Mar 23 03:03:25.715854 2026] [:error] [pid 20584:tid 20632] [client 20.220.223.1:36846] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ioxi-o1.php"] [unique_id "acA8_SWzr-bD_t6AP_TYrwAAAFA"]
[Mon Mar 23 03:03:26.593517 2026] [:error] [pid 20587:tid 20666] [client 20.220.223.1:36677] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ioxi-o1.php"] [unique_id "acA8_oByf8r3QAk4VXMAJQAAAJc"]
[Mon Mar 23 03:03:27.089360 2026] [:error] [pid 20584:tid 20618] [client 20.220.223.1:36809] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ioxi-o1.php"] [unique_id "acA8_yWzr-bD_t6AP_TYsgAAAEI"]
[Mon Mar 23 03:03:27.506401 2026] [:error] [pid 20574:tid 20599] [client 20.220.223.1:36851] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ioxi-o1.php"] [unique_id "acA8_9dMXEnEZrwyzJkeMwAAAAo"]
[Mon Mar 23 03:03:27.932634 2026] [:error] [pid 27776:tid 27871] [client 20.220.223.1:36703] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/juuuu.php"] [unique_id "acA8_43Eaq7IZ5L-4XV3GwAAARc"]
[Mon Mar 23 03:03:28.353524 2026] [:error] [pid 20574:tid 20596] [client 20.220.223.1:36762] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/juuuu.php"] [unique_id "acA9ANdMXEnEZrwyzJkeOAAAAAc"]
[Mon Mar 23 03:03:28.775064 2026] [:error] [pid 27776:tid 27857] [client 20.220.223.1:36842] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/juuuu.php"] [unique_id "acA9AI3Eaq7IZ5L-4XV3HwAAAQo"]
[Mon Mar 23 03:03:29.264887 2026] [:error] [pid 27776:tid 27862] [client 20.220.223.1:36641] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/juuuu.php"] [unique_id "acA9AY3Eaq7IZ5L-4XV3JQAAAQ8"]
[Mon Mar 23 03:03:29.768964 2026] [:error] [pid 27776:tid 27861] [client 20.220.223.1:36767] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ha.php"] [unique_id "acA9AY3Eaq7IZ5L-4XV3KQAAAQ4"]
[Mon Mar 23 03:03:30.377481 2026] [:error] [pid 20574:tid 20607] [client 20.220.223.1:36720] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ha.php"] [unique_id "acA9AtdMXEnEZrwyzJkePAAAABI"]
[Mon Mar 23 03:03:30.838382 2026] [:error] [pid 20574:tid 20611] [client 20.220.223.1:36610] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ha.php"] [unique_id "acA9AtdMXEnEZrwyzJkePgAAABY"]
[Mon Mar 23 03:03:31.336618 2026] [:error] [pid 20574:tid 20606] [client 20.220.223.1:36727] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ha.php"] [unique_id "acA9A9dMXEnEZrwyzJkeQgAAABE"]
[Mon Mar 23 03:03:31.761492 2026] [:error] [pid 27776:tid 27866] [client 20.220.223.1:36693] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/we2.php"] [unique_id "acA9A43Eaq7IZ5L-4XV3OgAAARM"]
[Mon Mar 23 03:03:32.188083 2026] [:error] [pid 27776:tid 27857] [client 20.220.223.1:36765] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/we2.php"] [unique_id "acA9BI3Eaq7IZ5L-4XV3PQAAAQo"]
[Mon Mar 23 03:03:32.654041 2026] [:error] [pid 20856:tid 20934] [client 20.220.223.1:36613] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/we2.php"] [unique_id "acA9BMxFtXFVNE-X2-K1bQAAAM8"]
[Mon Mar 23 03:03:33.311983 2026] [:error] [pid 20856:tid 20943] [client 20.220.223.1:36734] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/we2.php"] [unique_id "acA9BcxFtXFVNE-X2-K1bwAAANg"]
[Mon Mar 23 03:03:33.779772 2026] [:error] [pid 20856:tid 20928] [client 20.220.223.1:36764] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/04.php"] [unique_id "acA9BcxFtXFVNE-X2-K1cQAAAMk"]
[Mon Mar 23 03:03:34.211919 2026] [:error] [pid 20856:tid 20941] [client 20.220.223.1:36642] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/04.php"] [unique_id "acA9BsxFtXFVNE-X2-K1dAAAANY"]
[Mon Mar 23 03:03:34.633838 2026] [:error] [pid 20856:tid 20932] [client 20.220.223.1:36719] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/04.php"] [unique_id "acA9BsxFtXFVNE-X2-K1eQAAAM0"]
[Mon Mar 23 03:03:35.086329 2026] [:error] [pid 20856:tid 20934] [client 20.220.223.1:36790] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/04.php"] [unique_id "acA9B8xFtXFVNE-X2-K1fQAAAM8"]
[Mon Mar 23 03:03:35.511099 2026] [:error] [pid 20856:tid 20938] [client 20.220.223.1:36622] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/333.php"] [unique_id "acA9B8xFtXFVNE-X2-K1gQAAANM"]
[Mon Mar 23 03:03:35.960478 2026] [:error] [pid 20856:tid 20927] [client 20.220.223.1:36764] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/333.php"] [unique_id "acA9B8xFtXFVNE-X2-K1hwAAAMg"]
[Mon Mar 23 03:03:36.529421 2026] [:error] [pid 20584:tid 20624] [client 20.220.223.1:36559] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/333.php"] [unique_id "acA9CCWzr-bD_t6AP_TYvQAAAEg"]
[Mon Mar 23 03:03:37.039075 2026] [:error] [pid 27776:tid 27855] [client 20.220.223.1:36650] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/333.php"] [unique_id "acA9CY3Eaq7IZ5L-4XV3TwAAAQk"]
[Mon Mar 23 03:03:37.594552 2026] [:error] [pid 20584:tid 20635] [client 20.220.223.1:36702] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/520.php"] [unique_id "acA9CSWzr-bD_t6AP_TYxQAAAFM"]
[Mon Mar 23 03:03:38.107004 2026] [:error] [pid 27776:tid 27857] [client 20.220.223.1:36777] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/520.php"] [unique_id "acA9Co3Eaq7IZ5L-4XV3VgAAAQo"]
[Mon Mar 23 03:03:38.627298 2026] [:error] [pid 20574:tid 20595] [client 20.220.223.1:36625] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/520.php"] [unique_id "acA9CtdMXEnEZrwyzJkeRAAAAAY"]
[Mon Mar 23 03:03:39.062966 2026] [:error] [pid 27776:tid 27847] [client 20.220.223.1:36623] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/520.php"] [unique_id "acA9C43Eaq7IZ5L-4XV3WwAAAQE"]
[Mon Mar 23 03:03:39.671298 2026] [:error] [pid 20587:tid 20650] [client 20.220.223.1:36608] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ar.php"] [unique_id "acA9C4Byf8r3QAk4VXMALgAAAIc"]
[Mon Mar 23 03:03:40.278818 2026] [:error] [pid 20574:tid 20593] [client 20.220.223.1:36785] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ar.php"] [unique_id "acA9DNdMXEnEZrwyzJkeRwAAAAQ"]
[Mon Mar 23 03:03:41.007204 2026] [:error] [pid 27776:tid 27863] [client 20.220.223.1:36619] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ar.php"] [unique_id "acA9DY3Eaq7IZ5L-4XV3YAAAARA"]
[Mon Mar 23 03:03:42.721315 2026] [:error] [pid 20587:tid 20648] [client 20.220.223.1:36544] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ar.php"] [unique_id "acA9DoByf8r3QAk4VXMAOgAAAIU"]
[Mon Mar 23 03:03:43.350293 2026] [:error] [pid 20587:tid 20650] [client 20.220.223.1:36788] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/x.php"] [unique_id "acA9D4Byf8r3QAk4VXMAPgAAAIc"]
[Mon Mar 23 03:03:43.823876 2026] [:error] [pid 27776:tid 27852] [client 20.220.223.1:36706] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/x.php"] [unique_id "acA9D43Eaq7IZ5L-4XV3awAAAQY"]
[Mon Mar 23 03:03:44.241900 2026] [:error] [pid 20584:tid 20620] [client 20.220.223.1:36780] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/x.php"] [unique_id "acA9ECWzr-bD_t6AP_TYzgAAAEQ"]
[Mon Mar 23 03:03:44.742429 2026] [:error] [pid 20584:tid 20630] [client 20.220.223.1:36713] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/x.php"] [unique_id "acA9ECWzr-bD_t6AP_TY0QAAAE4"]
[Mon Mar 23 03:03:45.156872 2026] [:error] [pid 20587:tid 20657] [client 20.220.223.1:36630] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xx.php"] [unique_id "acA9EYByf8r3QAk4VXMARgAAAI4"]
[Mon Mar 23 03:03:45.605788 2026] [:error] [pid 20587:tid 20654] [client 20.220.223.1:36723] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xx.php"] [unique_id "acA9EYByf8r3QAk4VXMASQAAAIs"]
[Mon Mar 23 03:03:46.025339 2026] [:error] [pid 20584:tid 20632] [client 20.220.223.1:36634] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xx.php"] [unique_id "acA9EiWzr-bD_t6AP_TY1gAAAFA"]
[Mon Mar 23 03:03:46.478639 2026] [:error] [pid 20574:tid 20589] [client 20.220.223.1:36660] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xx.php"] [unique_id "acA9EtdMXEnEZrwyzJkeUQAAAAA"]
[Mon Mar 23 03:03:46.894633 2026] [:error] [pid 27776:tid 27851] [client 20.220.223.1:36735] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gifclass4.php"] [unique_id "acA9Eo3Eaq7IZ5L-4XV3cgAAAQU"]
[Mon Mar 23 03:03:47.414999 2026] [:error] [pid 20587:tid 20653] [client 20.220.223.1:36554] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gifclass4.php"] [unique_id "acA9E4Byf8r3QAk4VXMASwAAAIo"]
[Mon Mar 23 03:03:47.831546 2026] [:error] [pid 20587:tid 20663] [client 20.220.223.1:36796] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gifclass4.php"] [unique_id "acA9E4Byf8r3QAk4VXMATgAAAJQ"]
[Mon Mar 23 03:03:48.286803 2026] [:error] [pid 27776:tid 27864] [client 20.220.223.1:36678] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gifclass4.php"] [unique_id "acA9FI3Eaq7IZ5L-4XV3dwAAARE"]
[Mon Mar 23 03:03:48.737409 2026] [:error] [pid 20587:tid 20652] [client 20.220.223.1:36793] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/2clas.php"] [unique_id "acA9FIByf8r3QAk4VXMAUgAAAIk"]
[Mon Mar 23 03:03:49.184084 2026] [:error] [pid 27776:tid 27850] [client 20.220.223.1:36858] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/2clas.php"] [unique_id "acA9FY3Eaq7IZ5L-4XV3ewAAAQQ"]
[Mon Mar 23 03:03:49.618796 2026] [:error] [pid 20587:tid 20654] [client 20.220.223.1:36789] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/2clas.php"] [unique_id "acA9FYByf8r3QAk4VXMAVAAAAIs"]
[Mon Mar 23 03:03:50.068027 2026] [:error] [pid 27776:tid 27851] [client 20.220.223.1:36635] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/2clas.php"] [unique_id "acA9Fo3Eaq7IZ5L-4XV3hQAAAQU"]
[Mon Mar 23 03:03:50.606636 2026] [:error] [pid 20574:tid 20605] [client 20.220.223.1:36632] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ave.php"] [unique_id "acA9FtdMXEnEZrwyzJkeWAAAABA"]
[Mon Mar 23 03:03:51.017865 2026] [:error] [pid 20856:tid 20939] [client 20.220.223.1:36701] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ave.php"] [unique_id "acA9F8xFtXFVNE-X2-K1lgAAANQ"]
[Mon Mar 23 03:03:51.447821 2026] [:error] [pid 20856:tid 20919] [client 20.220.223.1:36666] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ave.php"] [unique_id "acA9F8xFtXFVNE-X2-K1mAAAAMA"]
[Mon Mar 23 03:03:51.914902 2026] [:error] [pid 20574:tid 20612] [client 20.220.223.1:36652] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ave.php"] [unique_id "acA9F9dMXEnEZrwyzJkeXQAAABc"]
[Mon Mar 23 04:48:59.142517 2026] [:error] [pid 23440:tid 23484] [client 20.220.61.78:10786] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "acBVuz49_8n8h_ttcUq-wQAAAEg"]
[Mon Mar 23 17:44:21.929961 2026] [:error] [pid 23440:tid 23499] [client 20.63.98.227:4207] [client 20.63.98.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/1.php"] [unique_id "acELdT49_8n8h_ttcUos_wAAAFc"]
[Mon Mar 23 17:44:22.754759 2026] [:error] [pid 23439:tid 23460] [client 20.63.98.227:4241] [client 20.63.98.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/1.php"] [unique_id "acELdqZv8XIzUKdgaMeMOgAAAAs"]
[Mon Mar 23 17:44:23.588923 2026] [:error] [pid 23440:tid 23480] [client 20.63.98.227:4220] [client 20.63.98.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/1.php"] [unique_id "acELdz49_8n8h_ttcUotAQAAAEQ"]
[Mon Mar 23 17:44:24.414160 2026] [:error] [pid 23441:tid 23527] [client 20.63.98.227:4232] [client 20.63.98.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/1.php"] [unique_id "acELeBq7S-oOqSXZEr7T2QAAAJg"]
[Mon Mar 23 21:28:13.325208 2026] [:error] [pid 38306:tid 38323] [client 181.224.206.148:55567] [client 181.224.206.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.224.206.148, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acE_7TkL8qwu-hHc6Bii1AAAAQ8"]
[Mon Mar 23 22:13:34.875963 2026] [autoindex:error] [pid 38176:tid 38191] [client 40.85.246.124:62713] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Mar 23 22:13:35.532705 2026] [:error] [pid 38176:tid 38187] [client 40.85.246.124:62698] [client 40.85.246.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "acFKj0tG4qlh1gvNjuJK5AAAAAA"]
[Mon Mar 23 23:43:10.201366 2026] [autoindex:error] [pid 38306:tid 38308] [client 40.85.246.124:22408] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Mar 23 23:43:10.862592 2026] [:error] [pid 52341:tid 52364] [client 40.85.246.124:22403] [client 40.85.246.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "acFfjqPKTBDR2u47Gb0pewAAAVU"]
[Mon Mar 23 23:59:25.926463 2026] [:error] [pid 52341:tid 52351] [client 20.220.216.188:40779] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "acFjXaPKTBDR2u47Gb01mwAAAUg"]
[Mon Mar 23 23:59:48.766338 2026] [:error] [pid 52341:tid 52363] [client 20.220.216.188:40904] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "acFjdKPKTBDR2u47Gb01-wAAAVQ"]
[Mon Mar 23 23:59:51.012119 2026] [:error] [pid 38176:tid 38206] [client 20.220.216.188:40863] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "acFjd0tG4qlh1gvNjuJuowAAABM"]
[Mon Mar 23 23:59:53.411774 2026] [:error] [pid 38178:tid 38246] [client 20.220.216.188:40953] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "acFjeQ0axWfXsVvR9udihwAAAIQ"]
[Mon Mar 23 23:59:54.910412 2026] [:error] [pid 38176:tid 38207] [client 20.220.216.188:40784] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "acFjektG4qlh1gvNjuJuqQAAABQ"]
[Mon Mar 23 23:59:57.273133 2026] [proxy_fcgi:error] [pid 38306:tid 38331] [client 20.220.216.188:40880] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 00:00:53.653325 2026] [:error] [pid 52341:tid 52349] [client 20.220.216.188:40941] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "acFjtaPKTBDR2u47Gb02tQAAAUY"]
[Tue Mar 24 00:00:54.841362 2026] [:error] [pid 38178:tid 38264] [client 20.220.216.188:40801] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "acFjtg0axWfXsVvR9udi_wAAAJY"]
[Tue Mar 24 00:00:56.063886 2026] [:error] [pid 38176:tid 38204] [client 20.220.216.188:40841] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "acFjuEtG4qlh1gvNjuJu8AAAABE"]
[Tue Mar 24 00:00:57.003313 2026] [:error] [pid 38276:tid 38294] [client 20.220.216.188:40855] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "acFjuZoKGiI-a7oME3IhrAAAAM8"]
[Tue Mar 24 00:00:57.827993 2026] [:error] [pid 38276:tid 38298] [client 20.220.216.188:40809] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "acFjuZoKGiI-a7oME3IhrwAAANM"]
[Tue Mar 24 00:00:58.299609 2026] [:error] [pid 38276:tid 38290] [client 20.220.216.188:40814] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/radio.php"] [unique_id "acFjupoKGiI-a7oME3IhsQAAAMs"]
[Tue Mar 24 00:00:58.953944 2026] [:error] [pid 52341:tid 52345] [client 20.220.216.188:40781] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/radio.php"] [unique_id "acFjuqPKTBDR2u47Gb02yQAAAUI"]
[Tue Mar 24 00:00:59.607038 2026] [:error] [pid 38276:tid 38302] [client 20.220.216.188:40866] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/radio.php"] [unique_id "acFju5oKGiI-a7oME3IhugAAANc"]
[Tue Mar 24 00:01:00.349528 2026] [:error] [pid 52341:tid 52354] [client 20.220.216.188:40844] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/radio.php"] [unique_id "acFjvKPKTBDR2u47Gb02zAAAAUs"]
[Tue Mar 24 00:01:00.863605 2026] [:error] [pid 52341:tid 52366] [client 20.220.216.188:40845] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "acFjvKPKTBDR2u47Gb02zQAAAVc"]
[Tue Mar 24 00:01:01.597645 2026] [:error] [pid 52341:tid 52348] [client 20.220.216.188:40782] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "acFjvaPKTBDR2u47Gb020AAAAUU"]
[Tue Mar 24 00:01:02.057386 2026] [:error] [pid 52341:tid 52344] [client 20.220.216.188:40788] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "acFjvqPKTBDR2u47Gb020wAAAUE"]
[Tue Mar 24 00:01:02.482607 2026] [:error] [pid 38177:tid 38223] [client 20.220.216.188:40796] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "acFjvnsYW-_HCI66MukPPwAAAEg"]
[Tue Mar 24 00:01:02.973610 2026] [:error] [pid 38178:tid 38244] [client 20.220.216.188:40867] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/admin.php"] [unique_id "acFjvg0axWfXsVvR9udjCQAAAII"]
[Tue Mar 24 00:01:03.469500 2026] [:error] [pid 38276:tid 38293] [client 20.220.216.188:40876] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/admin.php"] [unique_id "acFjv5oKGiI-a7oME3IhvwAAAM4"]
[Tue Mar 24 00:01:04.045249 2026] [:error] [pid 38178:tid 38250] [client 20.220.216.188:40817] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/admin.php"] [unique_id "acFjwA0axWfXsVvR9udjCwAAAIg"]
[Tue Mar 24 00:01:04.491185 2026] [:error] [pid 52341:tid 52353] [client 20.220.216.188:40882] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/admin.php"] [unique_id "acFjwKPKTBDR2u47Gb021wAAAUo"]
[Tue Mar 24 00:01:05.128748 2026] [:error] [pid 52341:tid 52348] [client 20.220.216.188:40161] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/admin.php"] [unique_id "acFjwaPKTBDR2u47Gb023gAAAUU"]
[Tue Mar 24 00:01:05.849599 2026] [:error] [pid 38178:tid 38249] [client 20.220.216.188:40886] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/admin.php"] [unique_id "acFjwQ0axWfXsVvR9udjEAAAAIc"]
[Tue Mar 24 00:01:06.544912 2026] [:error] [pid 38178:tid 38242] [client 20.220.216.188:40901] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/admin.php"] [unique_id "acFjwg0axWfXsVvR9udjEQAAAIA"]
[Tue Mar 24 00:01:07.707945 2026] [:error] [pid 52341:tid 52343] [client 20.220.216.188:40865] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/admin.php"] [unique_id "acFjw6PKTBDR2u47Gb025wAAAUA"]
[Tue Mar 24 00:01:08.202221 2026] [:error] [pid 38306:tid 38314] [client 20.220.216.188:40805] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "acFjxDkL8qwu-hHc6BjifwAAAQY"]
[Tue Mar 24 00:01:09.292717 2026] [:error] [pid 52341:tid 52358] [client 20.220.216.188:40925] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "acFjxaPKTBDR2u47Gb026gAAAU8"]
[Tue Mar 24 00:01:09.833517 2026] [:error] [pid 38276:tid 38279] [client 20.220.216.188:40832] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "acFjxZoKGiI-a7oME3IhxgAAAMA"]
[Tue Mar 24 00:01:10.407744 2026] [:error] [pid 38276:tid 38299] [client 20.220.216.188:40142] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "acFjxpoKGiI-a7oME3IhyAAAANQ"]
[Tue Mar 24 00:01:11.218200 2026] [:error] [pid 38276:tid 38293] [client 20.220.216.188:40949] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "acFjx5oKGiI-a7oME3IhzAAAAM4"]
[Tue Mar 24 00:01:11.982127 2026] [:error] [pid 52341:tid 52363] [client 20.220.216.188:40914] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "acFjx6PKTBDR2u47Gb02-wAAAVQ"]
[Tue Mar 24 00:01:12.583143 2026] [:error] [pid 38276:tid 38301] [client 20.220.216.188:40935] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "acFjyJoKGiI-a7oME3Ih0AAAANY"]
[Tue Mar 24 00:01:13.323616 2026] [:error] [pid 38276:tid 38282] [client 20.220.216.188:40884] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "acFjyZoKGiI-a7oME3Ih1wAAAMM"]
[Tue Mar 24 00:01:13.928200 2026] [:error] [pid 38306:tid 38330] [client 20.220.216.188:40932] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/log.php"] [unique_id "acFjyTkL8qwu-hHc6BjiiAAAARY"]
[Tue Mar 24 00:01:14.628606 2026] [:error] [pid 38177:tid 38236] [client 20.220.216.188:40924] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/log.php"] [unique_id "acFjynsYW-_HCI66MukPTQAAAFU"]
[Tue Mar 24 00:01:15.348878 2026] [:error] [pid 38176:tid 38198] [client 20.220.216.188:40870] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/log.php"] [unique_id "acFjy0tG4qlh1gvNjuJvCAAAAAs"]
[Tue Mar 24 00:01:15.918649 2026] [:error] [pid 38176:tid 38204] [client 20.220.216.188:40790] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.well-known/log.php"] [unique_id "acFjy0tG4qlh1gvNjuJvCgAAABE"]
[Tue Mar 24 00:01:16.572654 2026] [:error] [pid 38306:tid 38313] [client 20.220.216.188:40173] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class.php"] [unique_id "acFjzDkL8qwu-hHc6BjijQAAAQU"]
[Tue Mar 24 00:01:17.270586 2026] [:error] [pid 38306:tid 38323] [client 20.220.216.188:40706] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class.php"] [unique_id "acFjzTkL8qwu-hHc6BjijwAAAQ8"]
[Tue Mar 24 00:01:17.995866 2026] [:error] [pid 38306:tid 38314] [client 20.220.216.188:40786] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class.php"] [unique_id "acFjzTkL8qwu-hHc6BjikAAAAQY"]
[Tue Mar 24 00:01:18.541854 2026] [:error] [pid 38306:tid 38311] [client 20.220.216.188:40787] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class.php"] [unique_id "acFjzjkL8qwu-hHc6BjikgAAAQM"]
[Tue Mar 24 00:01:19.432792 2026] [:error] [pid 38306:tid 38310] [client 20.220.216.188:40775] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bless5.php"] [unique_id "acFjzzkL8qwu-hHc6BjilgAAAQI"]
[Tue Mar 24 00:01:20.145895 2026] [:error] [pid 52341:tid 52362] [client 20.220.216.188:40802] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bless5.php"] [unique_id "acFj0KPKTBDR2u47Gb03DQAAAVM"]
[Tue Mar 24 00:01:21.423289 2026] [:error] [pid 38178:tid 38256] [client 20.220.216.188:40803] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bless5.php"] [unique_id "acFj0Q0axWfXsVvR9udjMgAAAI4"]
[Tue Mar 24 00:01:24.316139 2026] [:error] [pid 38177:tid 38222] [client 20.220.216.188:40858] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "acFj1HsYW-_HCI66MukPXgAAAEc"]
[Tue Mar 24 00:01:24.987000 2026] [:error] [pid 38177:tid 38226] [client 20.220.216.188:40827] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "acFj1HsYW-_HCI66MukPYwAAAEs"]
[Tue Mar 24 01:31:39.247321 2026] [autoindex:error] [pid 31798:tid 31816] [client 178.18.245.70:49388] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Mar 24 04:54:57.807343 2026] [:error] [pid 38767:tid 38792] [client 173.239.218.7:48637] [client 173.239.218.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "acGoofwkUqN4GJAI5oVVnQAAARY"]
[Tue Mar 24 09:02:46.791932 2026] [:error] [pid 3030:tid 3058] [client 185.223.152.147:41041] [client 185.223.152.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.147, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "acHitgyOuILyynfcqfkW6wAAAAk"]
[Tue Mar 24 16:09:14.366481 2026] [autoindex:error] [pid 3137:tid 3142] [client 20.6.131.235:60076] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Mar 24 18:04:38.687194 2026] [:error] [pid 64198:tid 64211] [client 49.48.90.127:2405] [client 49.48.90.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.48.90.127, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acJhtnVzJqf6OS_oSZ11PQAAAUs"]
[Tue Mar 24 20:56:20.138185 2026] [:error] [pid 48219:tid 48304] [client 4.232.147.7:46231] [client 4.232.147.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.232.147.7, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acKJ9Chf3b4R_lAIyv-GcQAAAhc"]
[Tue Mar 24 20:56:56.349940 2026] [autoindex:error] [pid 48128:tid 48150] [client 4.232.147.7:35953] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 20:57:10.946915 2026] [autoindex:error] [pid 3137:tid 3151] [client 4.232.147.7:44947] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 20:57:24.874470 2026] [:error] [pid 64198:tid 64220] [client 4.232.147.7:62431] [client 4.232.147.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "acKKNHVzJqf6OS_oSZ3DEAAAAVQ"]
[Tue Mar 24 20:57:27.895886 2026] [autoindex:error] [pid 3030:tid 3064] [client 4.232.147.7:47479] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 21:26:11.502886 2026] [:error] [pid 3137:tid 3144] [client 216.81.245.214:59550] [client 216.81.245.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "acKQ85dZesutm6dfYM9BsAAAAMU"]
[Tue Mar 24 23:20:30.496819 2026] [:error] [pid 3137:tid 3158] [client 103.177.253.30:2291] [client 103.177.253.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.177.253.30, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acKrvpdZesutm6dfYM9olgAAANM"]
[Wed Mar 25 03:07:00.036559 2026] [autoindex:error] [pid 58154:tid 58165] [client 164.68.111.175:57867] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Mar 25 04:57:17.462860 2026] [:error] [pid 892:tid 894] [client 89.251.0.68:43277] [client 89.251.0.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.68, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "acL6rST_G8WMU3T3yxofqAAAAMA"]
[Wed Mar 25 07:20:50.766491 2026] [:error] [pid 756:tid 858] [client 136.144.35.5:25065] [client 136.144.35.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.35.5, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "acMcUjOaW6oylMIDBCS38AAAAIY"]
[Wed Mar 25 16:30:10.889042 2026] [:error] [pid 26269:tid 26287] [client 83.110.118.10:54223] [client 83.110.118.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.110.118.10, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acOdEkn7e-ZQbaIs7qyprQAAAYs"]
[Wed Mar 25 17:11:00.618100 2026] [:error] [pid 892:tid 915] [client 94.247.172.129:18876] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.perthactive.com.au|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.perthactive.com.au"] [uri "/"] [unique_id "acOmpCT_G8WMU3T3yxq-4gAAANE"]
[Wed Mar 25 19:04:19.937748 2026] [:error] [pid 47989:tid 48004] [client 20.220.197.73:36536] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 26"] [hostname "perthactive.com.au"] [uri "/1.php"] [unique_id "acPBMyWKdJMhIccROjnLPwAAAU0"]
[Wed Mar 25 19:04:20.803799 2026] [:error] [pid 26449:tid 26468] [client 20.220.197.73:36530] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 26"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/2024/"] [unique_id "acPBNNpZ2T15NDqzAjF2MAAAAk8"]
[Wed Mar 25 19:04:21.653434 2026] [:error] [pid 25967:tid 25974] [client 20.220.197.73:36509] [client 20.220.197.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.197.73, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acPBNfg8Qtq7ZM4mSFlMSAAAA0I"]
[Wed Mar 25 19:04:21.653506 2026] [:error] [pid 25967:tid 25974] [client 20.220.197.73:36509] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acPBNfg8Qtq7ZM4mSFlMSAAAA0I"]
[Wed Mar 25 19:04:22.478606 2026] [:error] [pid 25967:tid 25990] [client 20.220.197.73:36522] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-corn-sample.php"] [unique_id "acPBNvg8Qtq7ZM4mSFlMSwAAA1I"]
[Wed Mar 25 19:04:23.301825 2026] [:error] [pid 756:tid 865] [client 20.220.197.73:36526] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/"] [unique_id "acPBNzOaW6oylMIDBCQdTAAAAI0"]
[Wed Mar 25 19:04:24.124776 2026] [:error] [pid 47989:tid 48000] [client 20.220.197.73:36529] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "acPBOCWKdJMhIccROjnLTAAAAUk"]
[Wed Mar 25 19:04:26.597792 2026] [:error] [pid 26321:tid 26343] [client 20.220.197.73:36505] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "acPBOvKO65qqGZCSPZpBJwAAAgQ"]
[Wed Mar 25 19:04:27.422754 2026] [:error] [pid 25875:tid 25902] [client 20.220.197.73:36184] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/server.php"] [unique_id "acPBOxJ38QkS3NyfshzsaQAAApU"]
[Wed Mar 25 19:04:28.273825 2026] [:error] [pid 47989:tid 47996] [client 20.220.197.73:36519] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/library/"] [unique_id "acPBPCWKdJMhIccROjnLXQAAAUU"]
[Wed Mar 25 19:04:29.122861 2026] [:error] [pid 47989:tid 48003] [client 20.220.197.73:36482] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/"] [unique_id "acPBPSWKdJMhIccROjnLYAAAAUw"]
[Wed Mar 25 19:04:29.952110 2026] [:error] [pid 25967:tid 25992] [client 20.220.197.73:36162] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wso.php"] [unique_id "acPBPfg8Qtq7ZM4mSFlMUwAAA1Q"]
[Wed Mar 25 19:04:30.780417 2026] [:error] [pid 25875:tid 25892] [client 20.220.197.73:36164] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acPBPhJ38QkS3NyfshzsbAAAAos"]
[Wed Mar 25 19:04:31.607625 2026] [:error] [pid 25967:tid 25988] [client 20.220.197.73:36504] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-file.php"] [unique_id "acPBP_g8Qtq7ZM4mSFlMWAAAA1A"]
[Wed Mar 25 19:04:32.436546 2026] [:error] [pid 47989:tid 47997] [client 20.220.197.73:36514] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/adminfuns.php"] [unique_id "acPBQCWKdJMhIccROjnLbgAAAUY"]
[Wed Mar 25 19:04:33.265586 2026] [:error] [pid 25967:tid 25975] [client 20.220.197.73:36520] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wk/index.php"] [unique_id "acPBQfg8Qtq7ZM4mSFlMYAAAA0M"]
[Wed Mar 25 19:04:34.090382 2026] [:error] [pid 47989:tid 48015] [client 20.220.197.73:36489] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-admin.php"] [unique_id "acPBQiWKdJMhIccROjnLbwAAAVg"]
[Wed Mar 25 19:04:34.919735 2026] [:error] [pid 47989:tid 48005] [client 20.220.197.73:36185] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "acPBQiWKdJMhIccROjnLdQAAAU4"]
[Wed Mar 25 19:04:35.745098 2026] [:error] [pid 47989:tid 48008] [client 20.220.197.73:36191] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-bindings/"] [unique_id "acPBQyWKdJMhIccROjnLfgAAAVE"]
[Wed Mar 25 19:04:36.577155 2026] [:error] [pid 47989:tid 48014] [client 20.220.197.73:36167] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/xmrlpc.php"] [unique_id "acPBRCWKdJMhIccROjnLhwAAAVc"]
[Wed Mar 25 19:04:37.403954 2026] [:error] [pid 26449:tid 26477] [client 20.220.197.73:36518] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acPBRdpZ2T15NDqzAjF2MgAAAlg"]
[Wed Mar 25 19:04:38.231995 2026] [:error] [pid 892:tid 914] [client 20.220.197.73:36174] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-admin/file.php"] [unique_id "acPBRiT_G8WMU3T3yxrOWwAAANA"]
[Wed Mar 25 19:04:39.087629 2026] [:error] [pid 47946:tid 47963] [client 20.220.197.73:36160] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/fields/"] [unique_id "acPBRzipQTqBMSeKYheB1wAAAQ8"]
[Wed Mar 25 19:04:39.912270 2026] [:error] [pid 25875:tid 25886] [client 20.220.197.73:36500] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/atomlib.php"] [unique_id "acPBRxJ38QkS3NyfshzscwAAAoU"]
[Wed Mar 25 19:04:40.743935 2026] [:error] [pid 25875:tid 25901] [client 20.220.197.73:36175] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/css/index.php"] [unique_id "acPBSBJ38QkS3NyfshzsdAAAApQ"]
[Wed Mar 25 19:04:41.571555 2026] [:error] [pid 25967:tid 25974] [client 20.220.197.73:36542] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-content/et-cache/"] [unique_id "acPBSfg8Qtq7ZM4mSFlMaAAAA0I"]
[Wed Mar 25 19:04:42.404634 2026] [:error] [pid 26269:tid 26293] [client 20.220.197.73:36510] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/about.php"] [unique_id "acPBSkn7e-ZQbaIs7qy3gAAAAZE"]
[Wed Mar 25 19:04:43.242838 2026] [:error] [pid 26321:tid 26343] [client 20.220.197.73:36516] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/admin.php"] [unique_id "acPBS_KO65qqGZCSPZpBOgAAAgQ"]
[Wed Mar 25 19:04:44.071192 2026] [:error] [pid 26449:tid 26457] [client 20.220.197.73:36527] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-content/index.php"] [unique_id "acPBTNpZ2T15NDqzAjF2NwAAAkQ"]
[Wed Mar 25 19:04:44.896530 2026] [:error] [pid 47989:tid 47997] [client 20.220.197.73:36189] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "acPBTCWKdJMhIccROjnLwgAAAUY"]
[Wed Mar 25 19:04:45.730320 2026] [:error] [pid 892:tid 896] [client 20.220.197.73:36690] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/"] [unique_id "acPBTST_G8WMU3T3yxrOXwAAAMI"]
[Wed Mar 25 19:04:46.559985 2026] [:error] [pid 25875:tid 25896] [client 20.220.197.73:36171] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/admin.php"] [unique_id "acPBThJ38QkS3NyfshzsfQAAAo8"]
[Wed Mar 25 19:04:47.385355 2026] [:error] [pid 25875:tid 25891] [client 20.220.197.73:36485] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/block/"] [unique_id "acPBTxJ38QkS3NyfshzsgAAAAoo"]
[Wed Mar 25 19:04:48.210050 2026] [:error] [pid 26321:tid 26365] [client 20.220.197.73:36170] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/as.php"] [unique_id "acPBUPKO65qqGZCSPZpBQQAAAhg"]
[Wed Mar 25 19:04:49.038735 2026] [:error] [pid 25967:tid 25990] [client 20.220.197.73:36179] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "acPBUfg8Qtq7ZM4mSFlMbwAAA1I"]
[Wed Mar 25 19:04:49.864506 2026] [:error] [pid 25967:tid 25975] [client 20.220.197.73:36172] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/buy.php"] [unique_id "acPBUfg8Qtq7ZM4mSFlMcgAAA0M"]
[Wed Mar 25 19:04:50.690459 2026] [:error] [pid 47989:tid 47996] [client 20.220.197.73:36212] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp.php"] [unique_id "acPBUiWKdJMhIccROjnL2QAAAUU"]
[Wed Mar 25 19:04:51.519019 2026] [:error] [pid 47989:tid 48009] [client 20.220.197.73:36708] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "acPBUyWKdJMhIccROjnL3AAAAVI"]
[Wed Mar 25 19:04:52.368362 2026] [:error] [pid 892:tid 904] [client 20.220.197.73:36513] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/about.PHP"] [unique_id "acPBVCT_G8WMU3T3yxrOYQAAAMY"]
[Wed Mar 25 19:04:53.216250 2026] [:error] [pid 25875:tid 25887] [client 20.220.197.73:36215] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "acPBVRJ38QkS3NyfshzshQAAAoY"]
[Wed Mar 25 19:04:54.066048 2026] [:error] [pid 47989:tid 48001] [client 20.220.197.73:36511] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "acPBViWKdJMhIccROjnL3gAAAUo"]
[Wed Mar 25 19:04:54.891874 2026] [:error] [pid 25875:tid 25893] [client 20.220.197.73:36539] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-content/edit.php"] [unique_id "acPBVhJ38QkS3NyfshzsiQAAAow"]
[Wed Mar 25 19:04:55.716200 2026] [:error] [pid 25875:tid 25885] [client 20.220.197.73:36533] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/sf.php"] [unique_id "acPBVxJ38QkS3NyfshzsjAAAAoQ"]
[Wed Mar 25 19:04:56.567080 2026] [:error] [pid 26321:tid 26357] [client 20.220.197.73:36538] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/index.php"] [unique_id "acPBWPKO65qqGZCSPZpBRgAAAhA"]
[Wed Mar 25 19:04:57.411960 2026] [:error] [pid 25875:tid 25887] [client 20.220.197.73:36528] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "acPBWRJ38QkS3NyfshzsjwAAAoY"]
[Wed Mar 25 19:04:58.234793 2026] [:error] [pid 892:tid 901] [client 20.220.197.73:36687] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/modern/"] [unique_id "acPBWiT_G8WMU3T3yxrOYgAAAMQ"]
[Wed Mar 25 19:04:59.058316 2026] [:error] [pid 25875:tid 25897] [client 20.220.197.73:36502] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/cgi-bin/"] [unique_id "acPBWxJ38QkS3NyfshzskwAAApA"]
[Wed Mar 25 19:04:59.884982 2026] [:error] [pid 26321:tid 26342] [client 20.220.197.73:36217] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/test1.php"] [unique_id "acPBW_KO65qqGZCSPZpBSgAAAgM"]
[Wed Mar 25 19:05:00.726250 2026] [:error] [pid 25969:tid 26035] [client 20.220.197.73:36488] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-cron.php"] [unique_id "acPBXBd3aEUmOfdKja8GcgAAA8k"]
[Wed Mar 25 19:05:01.573062 2026] [:error] [pid 26449:tid 26465] [client 20.220.197.73:36163] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/"] [unique_id "acPBXdpZ2T15NDqzAjF2RAAAAkw"]
[Wed Mar 25 19:05:02.399904 2026] [:error] [pid 25969:tid 26037] [client 20.220.197.73:36710] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/404.php"] [unique_id "acPBXhd3aEUmOfdKja8GcwAAA8s"]
[Wed Mar 25 19:05:03.257993 2026] [:error] [pid 47946:tid 47971] [client 20.220.197.73:36517] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/wp-content/1.php"] [unique_id "acPBXzipQTqBMSeKYheB2wAAARc"]
[Wed Mar 25 19:05:04.082102 2026] [:error] [pid 26321:tid 26363] [client 20.220.197.73:36540] [client 20.220.197.73] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.197.73 on wp-login.php, counter = 27"] [hostname "perthactive.com.au"] [uri "/images/index.php"] [unique_id "acPBYPKO65qqGZCSPZpBTAAAAhY"]
[Wed Mar 25 21:18:37.682333 2026] [:error] [pid 25967:tid 25994] [client 66.249.69.170:61866] [client 66.249.69.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.249.69.170, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "acPgrfg8Qtq7ZM4mSFlwrwAAA1Y"]
[Wed Mar 25 21:18:37.765039 2026] [:error] [pid 25967:tid 25992] [client 66.249.69.172:38675] [client 66.249.69.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.249.69.172, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "acPgrfg8Qtq7ZM4mSFlwsQAAA1Q"]
[Wed Mar 25 21:18:38.328368 2026] [:error] [pid 25967:tid 25990] [client 66.249.69.170:53502] [client 66.249.69.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.249.69.170, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "acPgrvg8Qtq7ZM4mSFlwswAAA1I"]
[Wed Mar 25 21:18:38.523009 2026] [:error] [pid 25875:tid 25902] [client 66.249.69.171:44558] [client 66.249.69.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.249.69.171, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "acPgrhJ38QkS3NyfshwkpQAAApU"]
[Wed Mar 25 23:21:34.506551 2026] [:error] [pid 25875:tid 25886] [client 49.207.63.217:38015] [client 49.207.63.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.207.63.217, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acP9fhJ38QkS3NyfshxX9QAAAoU"]
[Thu Mar 26 03:01:22.303080 2026] [:error] [pid 56131:tid 56157] [client 52.188.122.85:55901] [client 52.188.122.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "acQxAkg5t1V4ZYPCUhxIsAAAABI"]
[Thu Mar 26 03:39:22.517177 2026] [:error] [pid 56131:tid 56163] [client 136.144.35.186:60649] [client 136.144.35.186] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.35.186, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "acQ56kg5t1V4ZYPCUhxWmgAAABg"]
[Thu Mar 26 04:48:46.254663 2026] [autoindex:error] [pid 19712:tid 19797] [client 178.18.245.70:61921] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Mar 26 06:21:10.501760 2026] [:error] [pid 19818:tid 19820] [client 103.188.168.76:55216] [client 103.188.168.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.188.168.76, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acRf1szaSnm3d1BeM5ViCwAAAMA"]
[Thu Mar 26 06:35:20.138934 2026] [:error] [pid 60829:tid 60837] [client 189.130.240.27:37460] [client 189.130.240.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.130.240.27, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acRjKPTdjHKeZokybaT_XgAAAQY"]
[Thu Mar 26 06:44:04.537727 2026] [:error] [pid 19818:tid 19829] [client 202.47.36.212:61819] [client 202.47.36.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.36.212, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acRlNMzaSnm3d1BeM5V1aAAAAMk"]
[Thu Mar 26 07:12:53.245626 2026] [:error] [pid 31670:tid 31681] [client 192.3.207.218:57338] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/artisan"] [unique_id "acRr9TXVthXxCnWjOTQxhwAAAUk"]
[Thu Mar 26 07:12:53.724642 2026] [:error] [pid 31670:tid 31676] [client 192.3.207.218:57893] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/artisan"] [unique_id "acRr9TXVthXxCnWjOTQxlwAAAUQ"]
[Thu Mar 26 07:12:54.854684 2026] [:error] [pid 19710:tid 19738] [client 192.3.207.218:58498] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.perthactive.com.au"] [uri "/artisan"] [unique_id "acRr9gVEWP8Ar68Njk6pMwAAABA"]
[Thu Mar 26 07:12:55.290301 2026] [:error] [pid 19712:tid 19784] [client 192.3.207.218:59219] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.perthactive.com.au"] [uri "/artisan"] [unique_id "acRr99WhKhRNqm23vFPeYAAAAIg"]
[Thu Mar 26 07:12:56.164877 2026] [:error] [pid 31670:tid 31685] [client 192.3.207.218:59698] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "acRr-DXVthXxCnWjOTQx4gAAAU0"]
[Thu Mar 26 07:12:56.637962 2026] [:error] [pid 19710:tid 19745] [client 192.3.207.218:60551] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "acRr-AVEWP8Ar68Njk6pYAAAABc"]
[Thu Mar 26 20:41:14.910722 2026] [:error] [pid 31670:tid 31696] [client 41.142.219.58:49835] [client 41.142.219.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.142.219.58, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acUpajXVthXxCnWjOTS-jgAAAVg"]
[Thu Mar 26 21:54:03.262086 2026] [:error] [pid 19712:tid 19785] [client 4.206.17.96:12707] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/1.php"] [unique_id "acU6e9WhKhRNqm23vFNISwAAAIk"]
[Thu Mar 26 21:54:04.089583 2026] [:error] [pid 19711:tid 19758] [client 4.206.17.96:12733] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 19"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/2024/"] [unique_id "acU6fGj3l1y81GYfluSyRgAAAEk"]
[Thu Mar 26 21:54:04.953962 2026] [:error] [pid 19711:tid 19763] [client 4.206.17.96:12480] [client 4.206.17.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.206.17.96, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acU6fGj3l1y81GYfluSyRwAAAE4"]
[Thu Mar 26 21:54:04.954025 2026] [:error] [pid 19711:tid 19763] [client 4.206.17.96:12480] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acU6fGj3l1y81GYfluSyRwAAAE4"]
[Thu Mar 26 21:54:05.790631 2026] [:error] [pid 19712:tid 19780] [client 4.206.17.96:12492] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-corn-sample.php"] [unique_id "acU6fdWhKhRNqm23vFNIUAAAAIQ"]
[Thu Mar 26 21:54:06.619809 2026] [:error] [pid 19711:tid 19749] [client 4.206.17.96:12710] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/"] [unique_id "acU6fmj3l1y81GYfluSySwAAAEA"]
[Thu Mar 26 21:54:07.446457 2026] [:error] [pid 19712:tid 19789] [client 4.206.17.96:12704] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "acU6f9WhKhRNqm23vFNIWgAAAI0"]
[Thu Mar 26 21:54:08.275198 2026] [:error] [pid 60829:tid 60837] [client 4.206.17.96:12680] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "acU6gPTdjHKeZokybaTaFwAAAQY"]
[Thu Mar 26 21:54:09.098963 2026] [:error] [pid 19710:tid 19734] [client 4.206.17.96:12681] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/server.php"] [unique_id "acU6gQVEWP8Ar68Njk4l6AAAAAw"]
[Thu Mar 26 21:54:09.924566 2026] [:error] [pid 19712:tid 19792] [client 4.206.17.96:12729] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/library/"] [unique_id "acU6gdWhKhRNqm23vFNIXwAAAJA"]
[Thu Mar 26 21:54:10.754497 2026] [:error] [pid 31670:tid 31695] [client 4.206.17.96:12490] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/"] [unique_id "acU6gjXVthXxCnWjOTTVbAAAAVc"]
[Thu Mar 26 21:54:11.597048 2026] [:error] [pid 19710:tid 19723] [client 4.206.17.96:12684] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wso.php"] [unique_id "acU6gwVEWP8Ar68Njk4l6gAAAAE"]
[Thu Mar 26 21:54:12.450796 2026] [:error] [pid 19712:tid 19779] [client 4.206.17.96:12695] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acU6hNWhKhRNqm23vFNIaQAAAIM"]
[Thu Mar 26 21:54:13.293852 2026] [:error] [pid 19712:tid 19794] [client 4.206.17.96:12497] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-file.php"] [unique_id "acU6hdWhKhRNqm23vFNIbAAAAJI"]
[Thu Mar 26 21:54:14.121156 2026] [:error] [pid 19712:tid 19782] [client 4.206.17.96:12721] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/adminfuns.php"] [unique_id "acU6htWhKhRNqm23vFNIbgAAAIY"]
[Thu Mar 26 21:54:14.957204 2026] [:error] [pid 31778:tid 31804] [client 4.206.17.96:12725] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wk/index.php"] [unique_id "acU6hg3kybI2o-xasmAiwgAAAcs"]
[Thu Mar 26 21:54:15.786774 2026] [:error] [pid 19712:tid 19790] [client 4.206.17.96:12542] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-admin.php"] [unique_id "acU6h9WhKhRNqm23vFNIcAAAAI4"]
[Thu Mar 26 21:54:16.793069 2026] [:error] [pid 31778:tid 31810] [client 4.206.17.96:12701] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "acU6iA3kybI2o-xasmAiyAAAAdE"]
[Thu Mar 26 21:54:17.622287 2026] [:error] [pid 60829:tid 60846] [client 4.206.17.96:12482] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-bindings/"] [unique_id "acU6ifTdjHKeZokybaTaGgAAAQ8"]
[Thu Mar 26 21:54:18.449443 2026] [:error] [pid 19710:tid 19734] [client 4.206.17.96:12496] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/xmrlpc.php"] [unique_id "acU6igVEWP8Ar68Njk4l8wAAAAw"]
[Thu Mar 26 21:54:19.281458 2026] [:error] [pid 19711:tid 19768] [client 4.206.17.96:12672] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acU6i2j3l1y81GYfluSyVQAAAFM"]
[Thu Mar 26 21:54:20.105487 2026] [:error] [pid 19711:tid 19760] [client 4.206.17.96:12440] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-admin/file.php"] [unique_id "acU6jGj3l1y81GYfluSyVwAAAEs"]
[Thu Mar 26 21:54:20.930643 2026] [:error] [pid 19710:tid 19737] [client 4.206.17.96:12677] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/fields/"] [unique_id "acU6jAVEWP8Ar68Njk4l9QAAAA8"]
[Thu Mar 26 21:54:21.770393 2026] [:error] [pid 19712:tid 19780] [client 4.206.17.96:12687] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/atomlib.php"] [unique_id "acU6jdWhKhRNqm23vFNIdgAAAIQ"]
[Thu Mar 26 21:54:22.637807 2026] [:error] [pid 31670:tid 31695] [client 4.206.17.96:12499] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/css/index.php"] [unique_id "acU6jjXVthXxCnWjOTTVeAAAAVc"]
[Thu Mar 26 21:54:23.464765 2026] [:error] [pid 19710:tid 19724] [client 4.206.17.96:12719] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-content/et-cache/"] [unique_id "acU6jwVEWP8Ar68Njk4l9wAAAAI"]
[Thu Mar 26 21:54:24.292349 2026] [:error] [pid 19710:tid 19740] [client 4.206.17.96:12720] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/about.php"] [unique_id "acU6kAVEWP8Ar68Njk4l-gAAABI"]
[Thu Mar 26 21:54:25.137773 2026] [:error] [pid 19712:tid 19781] [client 4.206.17.96:12714] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/admin.php"] [unique_id "acU6kdWhKhRNqm23vFNIgAAAAIU"]
[Thu Mar 26 21:54:25.963387 2026] [:error] [pid 31778:tid 31814] [client 4.206.17.96:12723] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-content/index.php"] [unique_id "acU6kQ3kybI2o-xasmAiyQAAAdU"]
[Thu Mar 26 21:54:26.785949 2026] [:error] [pid 31780:tid 31839] [client 4.206.17.96:12493] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "acU6kpJDwZsy5O4ZXEjI7AAAAhI"]
[Thu Mar 26 21:54:27.612223 2026] [:error] [pid 19712:tid 19794] [client 4.206.17.96:12673] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/"] [unique_id "acU6k9WhKhRNqm23vFNIhQAAAJI"]
[Thu Mar 26 21:54:28.440708 2026] [:error] [pid 31670:tid 31682] [client 4.206.17.96:12510] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/admin.php"] [unique_id "acU6lDXVthXxCnWjOTTVfQAAAUo"]
[Thu Mar 26 21:54:29.272682 2026] [:error] [pid 19818:tid 19840] [client 4.206.17.96:12423] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/block/"] [unique_id "acU6lczaSnm3d1BeM5U6HQAAANQ"]
[Thu Mar 26 21:54:30.097165 2026] [:error] [pid 31780:tid 31834] [client 4.206.17.96:12683] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/as.php"] [unique_id "acU6lpJDwZsy5O4ZXEjI8gAAAg0"]
[Thu Mar 26 21:54:30.921136 2026] [:error] [pid 19712:tid 19784] [client 4.206.17.96:12489] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "acU6ltWhKhRNqm23vFNIkwAAAIg"]
[Thu Mar 26 21:54:31.749614 2026] [:error] [pid 19712:tid 19791] [client 4.206.17.96:12693] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/buy.php"] [unique_id "acU6l9WhKhRNqm23vFNIlwAAAI8"]
[Thu Mar 26 21:54:32.573049 2026] [:error] [pid 31670:tid 31674] [client 4.206.17.96:12715] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp.php"] [unique_id "acU6mDXVthXxCnWjOTTVgQAAAUI"]
[Thu Mar 26 21:54:33.407062 2026] [:error] [pid 19712:tid 19788] [client 4.206.17.96:12712] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "acU6mdWhKhRNqm23vFNInwAAAIw"]
[Thu Mar 26 21:54:34.231785 2026] [:error] [pid 31780:tid 31822] [client 4.206.17.96:12682] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/about.PHP"] [unique_id "acU6mpJDwZsy5O4ZXEjI9QAAAgI"]
[Thu Mar 26 21:54:35.061369 2026] [:error] [pid 19712:tid 19778] [client 4.206.17.96:12731] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "acU6m9WhKhRNqm23vFNIrgAAAII"]
[Thu Mar 26 21:54:35.890719 2026] [:error] [pid 19818:tid 19836] [client 4.206.17.96:12732] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "acU6m8zaSnm3d1BeM5U6IgAAANA"]
[Thu Mar 26 21:54:36.735488 2026] [:error] [pid 19818:tid 19830] [client 4.206.17.96:12518] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-content/edit.php"] [unique_id "acU6nMzaSnm3d1BeM5U6IwAAAMo"]
[Thu Mar 26 21:54:37.559799 2026] [:error] [pid 19711:tid 19753] [client 4.206.17.96:12509] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/sf.php"] [unique_id "acU6nWj3l1y81GYfluSyYwAAAEQ"]
[Thu Mar 26 21:54:38.386928 2026] [:error] [pid 31778:tid 31809] [client 4.206.17.96:12702] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/index.php"] [unique_id "acU6ng3kybI2o-xasmAizAAAAdA"]
[Thu Mar 26 21:54:39.210013 2026] [:error] [pid 19818:tid 19840] [client 4.206.17.96:12698] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "acU6n8zaSnm3d1BeM5U6JwAAANQ"]
[Thu Mar 26 21:54:40.033355 2026] [:error] [pid 19710:tid 19741] [client 4.206.17.96:12674] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/modern/"] [unique_id "acU6oAVEWP8Ar68Njk4mDAAAABM"]
[Thu Mar 26 21:54:40.858643 2026] [:error] [pid 19710:tid 19734] [client 4.206.17.96:12685] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/cgi-bin/"] [unique_id "acU6oAVEWP8Ar68Njk4mEQAAAAw"]
[Thu Mar 26 21:54:41.688331 2026] [:error] [pid 19710:tid 19723] [client 4.206.17.96:12486] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/test1.php"] [unique_id "acU6oQVEWP8Ar68Njk4mFgAAAAE"]
[Thu Mar 26 21:54:42.509848 2026] [:error] [pid 19818:tid 19833] [client 4.206.17.96:12481] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-cron.php"] [unique_id "acU6oszaSnm3d1BeM5U6KAAAAM0"]
[Thu Mar 26 21:54:43.336298 2026] [:error] [pid 19710:tid 19728] [client 4.206.17.96:12709] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/"] [unique_id "acU6owVEWP8Ar68Njk4mHAAAAAY"]
[Thu Mar 26 21:54:44.160055 2026] [:error] [pid 19818:tid 19827] [client 4.206.17.96:12711] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/404.php"] [unique_id "acU6pMzaSnm3d1BeM5U6KgAAAMc"]
[Thu Mar 26 21:54:44.987588 2026] [:error] [pid 19711:tid 19765] [client 4.206.17.96:12706] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/wp-content/1.php"] [unique_id "acU6pGj3l1y81GYfluSyagAAAFA"]
[Thu Mar 26 21:54:45.809874 2026] [:error] [pid 19712:tid 19776] [client 4.206.17.96:12529] [client 4.206.17.96] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.206.17.96 on wp-login.php, counter = 20"] [hostname "perthactive.com.au"] [uri "/images/index.php"] [unique_id "acU6pdWhKhRNqm23vFNIwQAAAIA"]
[Fri Mar 27 01:38:15.072988 2026] [:error] [pid 44058:tid 44080] [client 185.169.4.152:59108] [client 185.169.4.152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "acVvB-qp9u5CVRGdZPH_uAAAAJQ"]
[Fri Mar 27 01:38:15.746804 2026] [:error] [pid 62551:tid 62556] [client 185.169.4.152:58580] [client 185.169.4.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.vscode/sftp.json"] [unique_id "acVvB4QvFHgfE1g4p7CRSAAAAcI"]
[Fri Mar 27 02:27:08.196507 2026] [:error] [pid 62148:tid 62515] [client 103.198.154.29:61212] [client 103.198.154.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.198.154.29, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acV6fIduik-mTruBKFV6TwAAAFI"]
[Fri Mar 27 08:05:09.997763 2026] [autoindex:error] [pid 63897:tid 63903] [client 85.203.23.78:55703] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/php-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 27 08:05:10.086858 2026] [:error] [pid 63897:tid 63920] [client 85.203.23.78:55703] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/codemirror/config.php"] [unique_id "acXJtmVSkmYmLu7ycYgybAAAARU"]
[Fri Mar 27 10:05:42.353133 2026] [autoindex:error] [pid 4293:tid 4317] [client 213.199.63.167:50566] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Mar 27 16:57:17.231631 2026] [:error] [pid 27750:tid 27832] [client 106.192.123.221:51396] [client 106.192.123.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.192.123.221, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acZGbYaSil5rd17ieLzKVwAAAI4"]
[Fri Mar 27 21:56:22.372694 2026] [:error] [pid 63897:tid 63900] [client 217.216.37.53:54729] [client 217.216.37.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "acaMhmVSkmYmLu7ycYhnZQAAAQE"]
[Fri Mar 27 21:56:22.583791 2026] [:error] [pid 63897:tid 63901] [client 217.216.37.53:56125] [client 217.216.37.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "acaMhmVSkmYmLu7ycYhnZgAAAQI"]
[Fri Mar 27 21:56:22.795331 2026] [:error] [pid 4293:tid 4308] [client 217.216.37.53:56696] [client 217.216.37.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/media/system/js/core.js"] [unique_id "acaMhpLjeJUC3OKtEx-7mgAAAU0"]
[Sat Mar 28 03:33:24.447119 2026] [:error] [pid 51701:tid 51711] [client 112.200.199.110:15832] [client 112.200.199.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.200.199.110, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acbbhBcCy4vzov4lZDYwpQAAAYg"]
[Sat Mar 28 03:35:43.833571 2026] [:error] [pid 11325:tid 11754] [client 77.222.235.88:48068] [client 77.222.235.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.222.235.88, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acbcD49aMci1IHcmG6IbswAAAM0"]
[Sat Mar 28 04:12:30.234568 2026] [:error] [pid 64966:tid 64977] [client 104.28.163.82:19115] [client 104.28.163.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/style.php"] [unique_id "acbkrtfSvF5AFfSuKxXTJAAAAMQ"]
[Sat Mar 28 18:33:24.542142 2026] [:error] [pid 34631:tid 34683] [client 177.55.93.141:24845] [client 177.55.93.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.55.93.141, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aceudDtzjMMS6kojpeQf6QAAAdc"]
[Sat Mar 28 18:38:58.133766 2026] [:error] [pid 43578:tid 43588] [client 104.28.200.202:37662] [client 104.28.200.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.200.202, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acevwnNG2YdGm41aN8LVOQAAAkc"]
[Sun Mar 29 03:14:30.435374 2026] [:error] [pid 60346:tid 60359] [client 185.192.71.23:49905] [client 185.192.71.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.23, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "acgolnVrXSgLxlxLi9BftQAAAQg"]
[Sun Mar 29 04:06:59.594793 2026] [:error] [pid 32254:tid 32272] [client 168.144.45.6:52013] [client 168.144.45.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.144.45.6, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acg046ug2IHuyGgCTn_6xgAAAAg"]
[Sun Mar 29 04:34:36.407782 2026] [autoindex:error] [pid 32255:tid 32308] [client 173.212.207.196:53040] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Mar 29 09:19:49.399991 2026] [:error] [pid 32257:tid 32340] [client 122.172.81.218:24351] [client 122.172.81.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.172.81.218, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ach-NSE3TArOFrUtgWpnuQAAAJY"]
[Sun Mar 29 13:26:26.004601 2026] [:error] [pid 32257:tid 32326] [client 41.254.76.130:19865] [client 41.254.76.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.254.76.130, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aci4AiE3TArOFrUtgWqO0wAAAIg"]
[Sun Mar 29 19:03:43.592197 2026] [:error] [pid 8818:tid 8829] [client 20.226.4.6:22796] [client 20.226.4.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.226.4.6, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ackHDyCDvotZNSF0FBq-5wAAAUc"]
[Sun Mar 29 19:03:46.160115 2026] [autoindex:error] [pid 23168:tid 23198] [client 20.226.4.6:26148] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 19:03:51.647558 2026] [autoindex:error] [pid 32255:tid 32302] [client 20.226.4.6:11758] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 19:03:53.243778 2026] [autoindex:error] [pid 32257:tid 32320] [client 20.226.4.6:22788] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 19:04:02.601767 2026] [:error] [pid 8818:tid 8836] [client 20.226.4.6:11753] [client 20.226.4.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ackHIiCDvotZNSF0FBq-9QAAAU4"]
[Sun Mar 29 19:04:05.134017 2026] [autoindex:error] [pid 8818:tid 8824] [client 20.226.4.6:26120] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 19:04:12.196699 2026] [:error] [pid 32257:tid 32332] [client 20.226.4.6:11682] [client 20.226.4.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "ackHLCE3TArOFrUtgWrfRAAAAI4"]
[Sun Mar 29 19:04:13.441353 2026] [autoindex:error] [pid 23284:tid 23306] [client 20.226.4.6:26695] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 19:04:15.030758 2026] [autoindex:error] [pid 32255:tid 32314] [client 20.226.4.6:26718] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/block/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 19:04:16.631537 2026] [:error] [pid 32255:tid 32301] [client 20.226.4.6:11656] [client 20.226.4.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "ackHMGnfn-AtRoMbquyt4AAAAEo"]
[Sun Mar 29 19:04:28.229107 2026] [:error] [pid 23167:tid 23177] [client 20.226.4.6:12553] [client 20.226.4.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/index.php"] [unique_id "ackHPBIAHJCFaHff3_eZ7QAAAcc"]
[Sun Mar 29 19:04:30.743125 2026] [autoindex:error] [pid 32359:tid 32362] [client 20.226.4.6:12574] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 19:04:32.959381 2026] [autoindex:error] [pid 23137:tid 23140] [client 20.226.4.6:21810] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 21:52:07.863513 2026] [:error] [pid 23284:tid 23304] [client 68.221.68.58:31681] [client 68.221.68.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "ackuh4zBujdPHsq7wySc4gAAApI"]
[Sun Mar 29 21:52:28.731333 2026] [:error] [pid 32254:tid 32267] [client 68.221.68.58:32681] [client 68.221.68.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "ackunKug2IHuyGgCTn9cTAAAAAM"]
[Sun Mar 29 21:52:30.262750 2026] [:error] [pid 23250:tid 23260] [client 68.221.68.58:30842] [client 68.221.68.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "ackunpxrpj-dQjy1cvoEpwAAAkg"]
[Sun Mar 29 21:52:34.805152 2026] [:error] [pid 32255:tid 32306] [client 68.221.68.58:30802] [client 68.221.68.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "ackuomnfn-AtRoMbquztCQAAAE8"]
[Sun Mar 29 21:52:35.429751 2026] [:error] [pid 8818:tid 8843] [client 68.221.68.58:31641] [client 68.221.68.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "ackuoyCDvotZNSF0FBrfBQAAAVU"]
[Sun Mar 29 21:52:37.992101 2026] [:error] [pid 23167:tid 23171] [client 68.221.68.58:30844] [client 68.221.68.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "ackupRIAHJCFaHff3_fAfwAAAcE"]
[Sun Mar 29 21:53:08.655095 2026] [proxy_fcgi:error] [pid 8818:tid 8842] [client 68.221.68.58:31702] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 21:53:38.583823 2026] [:error] [pid 23168:tid 23212] [client 68.221.68.58:32593] [client 68.221.68.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.221.68.58, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "acku4mP8p0yRL8ot_2-caAAAAg8"]
[Sun Mar 29 21:54:20.304215 2026] [autoindex:error] [pid 23250:tid 23261] [client 68.221.68.58:30864] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 23:25:26.421575 2026] [:error] [pid 32257:tid 32331] [client 20.151.111.128:40566] [client 20.151.111.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.111.128, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aclEZiE3TArOFrUtgWpqCgAAAI0"]
[Sun Mar 29 23:25:34.258722 2026] [:error] [pid 32359:tid 32371] [client 20.151.111.128:54749] [client 20.151.111.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.151.111.128, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aclEbgMb8G3UzfQP3Wg7YgAAAMo"]
[Sun Mar 29 23:25:41.415378 2026] [autoindex:error] [pid 32257:tid 32319] [client 20.151.111.128:49161] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 23:25:41.626638 2026] [autoindex:error] [pid 32257:tid 32327] [client 20.151.111.128:49161] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 23:25:43.785702 2026] [autoindex:error] [pid 32255:tid 32296] [client 20.151.111.128:42249] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 23:25:43.991866 2026] [:error] [pid 32255:tid 32292] [client 20.151.111.128:42249] [client 20.151.111.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aclEd2nfn-AtRoMbquwX9wAAAEE"]
[Sun Mar 29 23:25:46.567980 2026] [autoindex:error] [pid 23137:tid 23149] [client 20.151.111.128:9274] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 23:25:46.778902 2026] [autoindex:error] [pid 23137:tid 23146] [client 20.151.111.128:9274] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 23:25:48.278038 2026] [autoindex:error] [pid 23284:tid 23298] [client 20.151.111.128:62821] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 23:25:48.488016 2026] [autoindex:error] [pid 23284:tid 23297] [client 20.151.111.128:62821] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Mar 30 01:17:21.656373 2026] [:error] [pid 32257:tid 32320] [client 20.220.61.78:8171] [client 20.220.61.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.61.78, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "acleoSE3TArOFrUtgWq-DwAAAII"]
[Mon Mar 30 01:17:27.144988 2026] [:error] [pid 8818:tid 8843] [client 20.220.61.78:8181] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "aclepyCDvotZNSF0FBoQKwAAAVU"]
[Mon Mar 30 01:17:37.215199 2026] [:error] [pid 32255:tid 32309] [client 20.220.61.78:8105] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aclesWnfn-AtRoMbquxPvgAAAFI"]
[Mon Mar 30 01:17:44.245777 2026] [:error] [pid 23168:tid 23214] [client 20.220.61.78:8146] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "acleuGP8p0yRL8ot_2_n8QAAAhE"]
[Mon Mar 30 01:17:44.700601 2026] [:error] [pid 23168:tid 23207] [client 20.220.61.78:8123] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/src/alfa-rex.php"] [unique_id "acleuGP8p0yRL8ot_2_n8wAAAgo"]
[Mon Mar 30 01:17:48.545311 2026] [:error] [pid 23167:tid 23180] [client 20.220.61.78:8177] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/themes.php"] [unique_id "aclevBIAHJCFaHff3_f69wAAAco"]
[Mon Mar 30 01:17:50.905851 2026] [:error] [pid 32257:tid 32329] [client 20.220.61.78:8013] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "acleviE3TArOFrUtgWq-UgAAAIs"]
[Mon Mar 30 01:17:54.381363 2026] [:error] [pid 23250:tid 23259] [client 20.220.61.78:8161] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Content/Type/index.php"] [unique_id "aclewpxrpj-dQjy1cvotKAAAAkc"]
[Mon Mar 30 01:17:55.595004 2026] [:error] [pid 32257:tid 32341] [client 20.220.61.78:8182] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aclewyE3TArOFrUtgWq-YgAAAJc"]
[Mon Mar 30 01:18:00.263984 2026] [:error] [pid 23284:tid 23295] [client 20.220.61.78:8150] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Content/Type/alfa-rex.php"] [unique_id "acleyIzBujdPHsq7wyQ5TAAAAok"]
[Mon Mar 30 01:18:04.109628 2026] [:error] [pid 23168:tid 23198] [client 20.220.61.78:8081] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "aclezGP8p0yRL8ot_2_oFgAAAgE"]
[Mon Mar 30 01:18:05.510124 2026] [:error] [pid 23167:tid 23179] [client 20.220.61.78:8184] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aclezRIAHJCFaHff3_f7BQAAAck"]
[Mon Mar 30 01:18:08.068309 2026] [:error] [pid 23168:tid 23210] [client 20.220.61.78:8176] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "acle0GP8p0yRL8ot_2_oHwAAAg0"]
[Mon Mar 30 01:18:09.050641 2026] [:error] [pid 32255:tid 32312] [client 20.220.61.78:8012] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/wp-login.php"] [unique_id "acle0Wnfn-AtRoMbquxQBwAAAFU"]
[Mon Mar 30 05:27:22.647420 2026] [:error] [pid 4139:tid 4167] [client 172.213.218.14:22359] [client 172.213.218.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "acmZOoYyhg47TZoaP9IYeAAAANQ"]
[Mon Mar 30 05:28:01.682900 2026] [:error] [pid 4139:tid 4170] [client 172.213.218.14:39207] [client 172.213.218.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "acmZYYYyhg47TZoaP9IYvQAAANc"]
[Mon Mar 30 05:28:05.169858 2026] [:error] [pid 4139:tid 4156] [client 172.213.218.14:56113] [client 172.213.218.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "acmZZYYyhg47TZoaP9IYxQAAAMk"]
[Mon Mar 30 05:28:08.370931 2026] [:error] [pid 4040:tid 4116] [client 172.213.218.14:59467] [client 172.213.218.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "acmZaAxlbJV8kpOpFvZcOQAAAIg"]
[Mon Mar 30 05:28:09.122603 2026] [:error] [pid 55884:tid 55973] [client 172.213.218.14:38903] [client 172.213.218.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "acmZaTjuYLVkve3VbhyWggAAARQ"]
[Mon Mar 30 05:28:14.576456 2026] [:error] [pid 55884:tid 55966] [client 172.213.218.14:39215] [client 172.213.218.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "acmZbjjuYLVkve3VbhyWjwAAAQ0"]
[Mon Mar 30 05:29:05.715657 2026] [proxy_fcgi:error] [pid 4034:tid 4097] [client 172.213.218.14:47938] AH01071: Got error 'Primary script unknown'
[Mon Mar 30 05:29:49.391693 2026] [:error] [pid 4040:tid 4112] [client 172.213.218.14:32693] [client 172.213.218.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.213.218.14, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "acmZzQxlbJV8kpOpFvZcrgAAAIQ"]
[Mon Mar 30 05:30:56.368119 2026] [autoindex:error] [pid 4139:tid 4164] [client 172.213.218.14:20494] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Mar 30 12:43:08.722978 2026] [:error] [pid 41941:tid 41950] [client 20.239.139.3:6855] [client 20.239.139.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.trash7206/index.php"] [unique_id "acn_XCB2g7BNCXGBOJOTngAAAQc"]
[Mon Mar 30 12:43:09.202807 2026] [:error] [pid 35343:tid 35350] [client 20.239.139.3:5766] [client 20.239.139.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.trash7206/index.php"] [unique_id "acn_XaP5HurqmbvwN-KQTQAAAAU"]
[Mon Mar 30 12:43:09.708026 2026] [:error] [pid 35250:tid 35316] [client 20.239.139.3:1743] [client 20.239.139.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.trash7206/index.php"] [unique_id "acn_XYaKM1MR6zcp2YPFsAAAAMU"]
[Mon Mar 30 12:43:10.205304 2026] [:error] [pid 35343:tid 35354] [client 20.239.139.3:1787] [client 20.239.139.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.trash7206/index.php"] [unique_id "acn_XqP5HurqmbvwN-KQcQAAAAk"]
[Mon Mar 30 13:44:08.875014 2026] [:error] [pid 35343:tid 35355] [client 185.171.30.36:26074] [client 185.171.30.36] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "acoNqKP5HurqmbvwN-K7KQAAAAo"]
[Mon Mar 30 19:18:37.767277 2026] [:error] [pid 12046:tid 12050] [client 162.158.87.220:10815] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/refs/heads/master"] [unique_id "acpcDZDbtlkoJ6ELn7gXHQAAAkE"]
[Mon Mar 30 19:18:37.768025 2026] [:error] [pid 11947:tid 11966] [client 162.158.87.219:9848] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/HEAD"] [unique_id "acpcDTSVtzzXIgk-FglC1QAAAhE"]
[Mon Mar 30 19:18:37.774702 2026] [:error] [pid 11947:tid 11954] [client 162.158.87.219:9840] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/index"] [unique_id "acpcDTSVtzzXIgk-FglC1gAAAgU"]
[Mon Mar 30 19:18:37.775458 2026] [:error] [pid 35249:tid 35294] [client 162.158.87.219:9851] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/logs/HEAD"] [unique_id "acpcDSqCKiTq85d6rgBRXgAAAIo"]
[Mon Mar 30 19:18:37.797151 2026] [:error] [pid 11947:tid 11951] [client 162.158.87.220:10817] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "acpcDTSVtzzXIgk-FglC1wAAAgI"]
[Mon Mar 30 19:18:37.798125 2026] [:error] [pid 35249:tid 35287] [client 162.158.87.219:9857] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/refs/heads/main"] [unique_id "acpcDSqCKiTq85d6rgBRXwAAAIM"]
[Mon Mar 30 19:18:38.767476 2026] [:error] [pid 35250:tid 35334] [client 162.158.87.220:10825] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local"] [unique_id "acpcDoaKM1MR6zcp2YNeswAAANc"]
[Mon Mar 30 19:18:38.777978 2026] [:error] [pid 12046:tid 12053] [client 162.158.87.220:10828] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production"] [unique_id "acpcDpDbtlkoJ6ELn7gXIAAAAkQ"]
[Mon Mar 30 19:18:38.785555 2026] [:error] [pid 35248:tid 35267] [client 162.158.87.219:9859] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "acpcDr3igMCgAQPFS_-KIgAAAE0"]
[Mon Mar 30 19:18:38.806903 2026] [:error] [pid 12046:tid 12063] [client 162.158.87.219:9863] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.development"] [unique_id "acpcDpDbtlkoJ6ELn7gXIQAAAk4"]
[Mon Mar 30 19:18:38.811546 2026] [:error] [pid 35250:tid 35325] [client 162.158.87.220:10834] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.dev"] [unique_id "acpcDoaKM1MR6zcp2YNetAAAAM4"]
[Mon Mar 30 19:18:38.829705 2026] [:error] [pid 35249:tid 35299] [client 162.158.87.220:10840] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.test"] [unique_id "acpcDiqCKiTq85d6rgBRYQAAAI8"]
[Mon Mar 30 19:18:39.779982 2026] [:error] [pid 35250:tid 35313] [client 162.158.87.219:9870] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.staging"] [unique_id "acpcD4aKM1MR6zcp2YNetwAAAMI"]
[Mon Mar 30 19:18:39.807537 2026] [:error] [pid 35250:tid 35320] [client 162.158.87.219:9879] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.bak"] [unique_id "acpcD4aKM1MR6zcp2YNeuAAAAMk"]
[Mon Mar 30 19:18:39.817158 2026] [:error] [pid 35250:tid 35319] [client 162.158.87.219:9876] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.backup"] [unique_id "acpcD4aKM1MR6zcp2YNeuQAAAMg"]
[Mon Mar 30 19:18:39.836360 2026] [:error] [pid 35250:tid 35316] [client 162.158.87.219:9883] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.old"] [unique_id "acpcD4aKM1MR6zcp2YNeugAAAMU"]
[Mon Mar 30 19:18:39.859442 2026] [:error] [pid 35250:tid 35324] [client 162.158.87.219:9891] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.save"] [unique_id "acpcD4aKM1MR6zcp2YNeuwAAAM0"]
[Mon Mar 30 19:18:39.890732 2026] [:error] [pid 35248:tid 35270] [client 162.158.87.219:9895] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.tmp"] [unique_id "acpcD73igMCgAQPFS_-KIwAAAFA"]
[Mon Mar 30 19:18:40.794076 2026] [:error] [pid 50663:tid 50681] [client 162.158.87.219:9897] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.example"] [unique_id "acpcEG28b9DKIAMEdfAaRQAAAZA"]
[Mon Mar 30 19:18:40.839403 2026] [:error] [pid 50663:tid 50675] [client 162.158.87.220:10842] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production.local"] [unique_id "acpcEG28b9DKIAMEdfAaRgAAAYo"]
[Mon Mar 30 19:18:40.847811 2026] [:error] [pid 50663:tid 50674] [client 162.158.87.219:9904] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.development.local"] [unique_id "acpcEG28b9DKIAMEdfAaSAAAAYk"]
[Mon Mar 30 19:18:40.871503 2026] [:error] [pid 50663:tid 50684] [client 162.158.87.220:10849] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/app/.env"] [unique_id "acpcEG28b9DKIAMEdfAaSgAAAZM"]
[Mon Mar 30 19:18:40.886123 2026] [:error] [pid 50663:tid 50685] [client 162.158.87.220:10847] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/config/.env"] [unique_id "acpcEG28b9DKIAMEdfAaSwAAAZQ"]
[Mon Mar 30 19:18:40.932955 2026] [:error] [pid 50663:tid 50682] [client 162.158.87.219:9908] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/backend/.env"] [unique_id "acpcEG28b9DKIAMEdfAaTAAAAZE"]
[Mon Mar 30 19:18:41.810505 2026] [:error] [pid 41941:tid 41944] [client 162.158.87.219:11007] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.env"] [unique_id "acpcESB2g7BNCXGBOJNqdwAAAQE"]
[Mon Mar 30 19:18:41.873398 2026] [:error] [pid 11947:tid 11967] [client 162.158.87.220:9583] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/admin/.env"] [unique_id "acpcETSVtzzXIgk-FglC4AAAAhI"]
[Mon Mar 30 19:18:41.901731 2026] [:error] [pid 50663:tid 50666] [client 162.158.87.220:9584] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/public/.env"] [unique_id "acpcEW28b9DKIAMEdfAaUQAAAYE"]
[Mon Mar 30 19:18:41.904785 2026] [:error] [pid 11947:tid 11951] [client 162.158.87.219:11015] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/core/.env"] [unique_id "acpcETSVtzzXIgk-FglC4QAAAgI"]
[Mon Mar 30 19:18:41.919006 2026] [:error] [pid 11947:tid 11961] [client 162.158.87.220:9589] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/private/.env"] [unique_id "acpcETSVtzzXIgk-FglC4gAAAgw"]
[Mon Mar 30 19:18:42.816824 2026] [:error] [pid 11947:tid 11968] [client 162.158.87.219:11024] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/config/.env.local"] [unique_id "acpcEjSVtzzXIgk-FglC6wAAAhM"]
[Mon Mar 30 19:18:42.898391 2026] [:error] [pid 11947:tid 11965] [client 162.158.87.220:9591] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.php"] [unique_id "acpcEjSVtzzXIgk-FglC7AAAAhA"]
[Mon Mar 30 19:18:42.925407 2026] [:error] [pid 41941:tid 41951] [client 162.158.87.219:11032] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.json"] [unique_id "acpcEiB2g7BNCXGBOJNqegAAAQg"]
[Mon Mar 30 19:18:42.938344 2026] [:error] [pid 12046:tid 12071] [client 162.158.87.220:9599] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env_backup"] [unique_id "acpcEpDbtlkoJ6ELn7gXJAAAAlY"]
[Mon Mar 30 19:18:42.976774 2026] [:error] [pid 35343:tid 35354] [client 162.158.87.220:9602] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env~"] [unique_id "acpcEqP5HurqmbvwN-IjAgAAAAk"]
[Mon Mar 30 19:18:43.044561 2026] [:error] [pid 64743:tid 64754] [client 162.158.87.219:11035] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env1"] [unique_id "acpcEyzmpVL6Ubzil4idlAAAAUk"]
[Mon Mar 30 19:18:43.834708 2026] [:error] [pid 50663:tid 50674] [client 162.158.87.220:9603] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env2"] [unique_id "acpcE228b9DKIAMEdfAaZAAAAYk"]
[Mon Mar 30 19:18:43.935828 2026] [:error] [pid 50663:tid 50667] [client 162.158.87.220:9611] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.dist"] [unique_id "acpcE228b9DKIAMEdfAaZQAAAYI"]
[Mon Mar 30 19:18:43.955495 2026] [:error] [pid 35249:tid 35298] [client 162.158.87.220:9617] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.envrc"] [unique_id "acpcEyqCKiTq85d6rgBRYwAAAI4"]
[Mon Mar 30 19:18:43.963347 2026] [:error] [pid 41941:tid 41952] [client 162.158.87.219:11037] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.orig"] [unique_id "acpcEyB2g7BNCXGBOJNqfgAAAQk"]
[Mon Mar 30 19:18:43.997822 2026] [:error] [pid 12106:tid 12108] [client 162.158.87.220:9625] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production.bak"] [unique_id "acpcE7IKxOs8TAdw7hcR9wAAAoA"]
[Mon Mar 30 19:18:44.066706 2026] [:error] [pid 12046:tid 12059] [client 162.158.87.219:11044] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.prod"] [unique_id "acpcFJDbtlkoJ6ELn7gXKAAAAko"]
[Mon Mar 30 19:18:44.838305 2026] [:error] [pid 11947:tid 11969] [client 162.158.87.219:11046] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.dev.local"] [unique_id "acpcFDSVtzzXIgk-FglC9AAAAhQ"]
[Mon Mar 30 19:18:44.944287 2026] [:error] [pid 11947:tid 11968] [client 162.158.87.220:9627] [client 162.158.87.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.docker"] [unique_id "acpcFDSVtzzXIgk-FglC9QAAAhM"]
[Mon Mar 30 19:18:44.967922 2026] [:error] [pid 50663:tid 50670] [client 162.158.87.219:11047] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.container"] [unique_id "acpcFG28b9DKIAMEdfAabAAAAYU"]
[Mon Mar 30 19:18:44.982099 2026] [:error] [pid 11947:tid 11967] [client 162.158.87.219:11052] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/docker/.env"] [unique_id "acpcFDSVtzzXIgk-FglC9gAAAhI"]
[Mon Mar 30 19:18:45.113102 2026] [:error] [pid 12046:tid 12063] [client 162.158.87.219:11060] [client 162.158.87.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/docker/.env.local"] [unique_id "acpcFZDbtlkoJ6ELn7gXKQAAAk4"]
[Mon Mar 30 19:19:04.596060 2026] [:error] [pid 50663:tid 50673] [client 162.158.3.93:10659] [client 162.158.3.93] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/home/.env"] [unique_id "acpcKG28b9DKIAMEdfAazAAAAYg"]
[Mon Mar 30 19:19:04.597011 2026] [:error] [pid 50663:tid 50676] [client 162.158.2.167:10008] [client 162.158.2.167] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/var/www/html/.env"] [unique_id "acpcKG28b9DKIAMEdfAazQAAAYs"]
[Mon Mar 30 19:19:04.597116 2026] [:error] [pid 11947:tid 11950] [client 162.158.3.141:12608] [client 162.158.3.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/root/.env"] [unique_id "acpcKDSVtzzXIgk-FglDDgAAAgE"]
[Mon Mar 30 19:19:04.880981 2026] [:error] [pid 35248:tid 35262] [client 162.158.2.167:10013] [client 162.158.2.167] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env_config"] [unique_id "acpcKL3igMCgAQPFS_-KQwAAAEg"]
[Mon Mar 30 19:19:04.883428 2026] [:error] [pid 35248:tid 35265] [client 162.158.3.93:10660] [client 162.158.3.93] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env_settings"] [unique_id "acpcKL3igMCgAQPFS_-KRAAAAEs"]
[Mon Mar 30 19:19:05.105284 2026] [:error] [pid 35248:tid 35272] [client 162.158.3.141:12616] [client 162.158.3.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local.backup"] [unique_id "acpcKb3igMCgAQPFS_-KRQAAAFI"]
[Mon Mar 30 19:19:24.557922 2026] [:error] [pid 12046:tid 12055] [client 162.158.3.81:11305] [client 162.158.3.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/refs/heads/master"] [unique_id "acpcPJDbtlkoJ6ELn7gXMwAAAkY"]
[Mon Mar 30 19:19:24.557974 2026] [:error] [pid 12046:tid 12063] [client 162.158.3.141:10971] [client 162.158.3.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/logs/HEAD"] [unique_id "acpcPJDbtlkoJ6ELn7gXMgAAAk4"]
[Mon Mar 30 19:19:24.568984 2026] [:error] [pid 12046:tid 12068] [client 162.158.3.109:10827] [client 162.158.3.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env_secret"] [unique_id "acpcPJDbtlkoJ6ELn7gXNAAAAlM"]
[Mon Mar 30 19:19:24.838194 2026] [:error] [pid 12046:tid 12067] [client 162.158.2.141:10556] [client 162.158.2.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/refs/heads/main"] [unique_id "acpcPJDbtlkoJ6ELn7gXNQAAAlI"]
[Mon Mar 30 19:19:24.841735 2026] [:error] [pid 12046:tid 12061] [client 162.158.3.94:10235] [client 162.158.3.94] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "acpcPJDbtlkoJ6ELn7gXNgAAAkw"]
[Mon Mar 30 19:19:25.065427 2026] [:error] [pid 11947:tid 11962] [client 162.158.3.141:10976] [client 162.158.3.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production"] [unique_id "acpcPTSVtzzXIgk-FglDLQAAAg0"]
[Mon Mar 30 19:19:25.115632 2026] [:error] [pid 12046:tid 12071] [client 162.158.2.167:9979] [client 162.158.2.167] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.development"] [unique_id "acpcPZDbtlkoJ6ELn7gXNwAAAlY"]
[Mon Mar 30 19:19:25.121395 2026] [:error] [pid 12046:tid 12060] [client 162.158.2.140:13665] [client 162.158.2.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.dev"] [unique_id "acpcPZDbtlkoJ6ELn7gXOAAAAks"]
[Mon Mar 30 19:19:25.342729 2026] [:error] [pid 35343:tid 35363] [client 162.158.3.110:10058] [client 162.158.3.110] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.test"] [unique_id "acpcPaP5HurqmbvwN-IjJAAAABI"]
[Mon Mar 30 19:19:25.395553 2026] [:error] [pid 35250:tid 35330] [client 162.158.2.166:9805] [client 162.158.2.166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.staging"] [unique_id "acpcPYaKM1MR6zcp2YNe1gAAANM"]
[Mon Mar 30 19:19:25.398670 2026] [:error] [pid 35250:tid 35317] [client 162.158.2.140:9627] [client 162.158.2.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.backup"] [unique_id "acpcPYaKM1MR6zcp2YNe1wAAAMY"]
[Mon Mar 30 19:19:25.622995 2026] [:error] [pid 11947:tid 11955] [client 162.158.3.141:10982] [client 162.158.3.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.bak"] [unique_id "acpcPTSVtzzXIgk-FglDLwAAAgY"]
[Mon Mar 30 19:19:25.673696 2026] [:error] [pid 35343:tid 35350] [client 162.158.3.110:10061] [client 162.158.3.110] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.old"] [unique_id "acpcPaP5HurqmbvwN-IjJgAAAAU"]
[Mon Mar 30 19:19:25.675463 2026] [:error] [pid 11947:tid 11966] [client 162.158.2.141:12378] [client 162.158.2.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.save"] [unique_id "acpcPTSVtzzXIgk-FglDMAAAAhE"]
[Mon Mar 30 19:19:25.899798 2026] [:error] [pid 11947:tid 11970] [client 162.158.3.98:13182] [client 162.158.3.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.tmp"] [unique_id "acpcPTSVtzzXIgk-FglDMQAAAhU"]
[Mon Mar 30 19:19:25.953339 2026] [:error] [pid 11947:tid 11954] [client 162.158.3.142:12381] [client 162.158.3.142] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.example"] [unique_id "acpcPTSVtzzXIgk-FglDMgAAAgU"]
[Mon Mar 30 19:19:25.955385 2026] [:error] [pid 12046:tid 12049] [client 162.158.2.140:9631] [client 162.158.2.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production.local"] [unique_id "acpcPZDbtlkoJ6ELn7gXOQAAAkA"]
[Mon Mar 30 19:19:26.257098 2026] [:error] [pid 35343:tid 35359] [client 162.158.2.141:12384] [client 162.158.2.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.development.local"] [unique_id "acpcPqP5HurqmbvwN-IjKQAAAA4"]
[Mon Mar 30 19:19:26.258507 2026] [:error] [pid 11947:tid 11959] [client 162.158.3.120:10796] [client 162.158.3.120] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/app/.env"] [unique_id "acpcPjSVtzzXIgk-FglDNQAAAgo"]
[Mon Mar 30 19:19:26.261757 2026] [:error] [pid 50663:tid 50688] [client 162.158.3.98:13186] [client 162.158.3.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/config/.env"] [unique_id "acpcPm28b9DKIAMEdfAbDQAAAZc"]
[Mon Mar 30 19:19:26.535372 2026] [:error] [pid 41941:tid 41967] [client 162.158.2.166:9808] [client 162.158.2.166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/backend/.env"] [unique_id "acpcPiB2g7BNCXGBOJNqoQAAARg"]
[Mon Mar 30 19:19:26.535883 2026] [:error] [pid 64743:tid 64756] [client 162.158.3.93:12537] [client 162.158.3.93] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.env"] [unique_id "acpcPizmpVL6Ubzil4idpwAAAUs"]
[Mon Mar 30 19:19:26.543858 2026] [:error] [pid 64743:tid 64767] [client 162.158.3.97:10750] [client 162.158.3.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/admin/.env"] [unique_id "acpcPizmpVL6Ubzil4idqAAAAVY"]
[Mon Mar 30 19:19:26.604302 2026] [:error] [pid 35343:tid 35345] [client 162.158.2.140:9637] [client 162.158.2.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/core/.env"] [unique_id "acpcPqP5HurqmbvwN-IjKgAAAAA"]
[Mon Mar 30 19:19:26.604718 2026] [:error] [pid 50663:tid 50666] [client 162.158.3.119:13673] [client 162.158.3.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/public/.env"] [unique_id "acpcPm28b9DKIAMEdfAbDgAAAYE"]
[Mon Mar 30 19:19:26.815595 2026] [:error] [pid 35249:tid 35307] [client 162.158.3.94:14251] [client 162.158.3.94] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/private/.env"] [unique_id "acpcPiqCKiTq85d6rgBRawAAAJc"]
[Mon Mar 30 19:19:26.826648 2026] [:error] [pid 41941:tid 41959] [client 162.158.3.97:10755] [client 162.158.3.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/config/.env.local"] [unique_id "acpcPiB2g7BNCXGBOJNqogAAARA"]
[Mon Mar 30 19:19:26.882746 2026] [:error] [pid 11947:tid 11955] [client 162.158.3.119:13674] [client 162.158.3.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.php"] [unique_id "acpcPjSVtzzXIgk-FglDOgAAAgY"]
[Mon Mar 30 19:19:27.094994 2026] [:error] [pid 11947:tid 11956] [client 162.158.2.140:9638] [client 162.158.2.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env_backup"] [unique_id "acpcPzSVtzzXIgk-FglDOwAAAgc"]
[Mon Mar 30 19:19:27.111443 2026] [:error] [pid 11947:tid 11954] [client 162.158.2.140:9644] [client 162.158.2.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env~"] [unique_id "acpcPzSVtzzXIgk-FglDPAAAAgU"]
[Mon Mar 30 19:19:27.139872 2026] [:error] [pid 35250:tid 35335] [client 162.158.3.141:10989] [client 162.158.3.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env1"] [unique_id "acpcP4aKM1MR6zcp2YNe2AAAANg"]
[Mon Mar 30 19:19:27.156786 2026] [:error] [pid 64743:tid 64754] [client 162.158.3.102:11014] [client 162.158.3.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env2"] [unique_id "acpcPyzmpVL6Ubzil4idqQAAAUk"]
[Mon Mar 30 19:19:27.373206 2026] [:error] [pid 35249:tid 35300] [client 162.158.3.109:11279] [client 162.158.3.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.dist"] [unique_id "acpcPyqCKiTq85d6rgBRbAAAAJA"]
[Mon Mar 30 19:19:27.396059 2026] [:error] [pid 35249:tid 35285] [client 162.158.3.119:13675] [client 162.158.3.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.envrc"] [unique_id "acpcPyqCKiTq85d6rgBRbQAAAIE"]
[Mon Mar 30 19:19:27.419319 2026] [:error] [pid 35343:tid 35365] [client 162.158.2.140:9646] [client 162.158.2.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.orig"] [unique_id "acpcP6P5HurqmbvwN-IjLAAAABQ"]
[Mon Mar 30 19:19:27.439900 2026] [:error] [pid 35343:tid 35364] [client 162.158.3.141:10995] [client 162.158.3.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production.bak"] [unique_id "acpcP6P5HurqmbvwN-IjLQAAABM"]
[Mon Mar 30 19:19:27.655508 2026] [:error] [pid 41941:tid 41966] [client 162.158.3.93:12556] [client 162.158.3.93] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.prod"] [unique_id "acpcPyB2g7BNCXGBOJNqpAAAARc"]
[Mon Mar 30 19:19:27.673637 2026] [:error] [pid 41941:tid 41947] [client 162.158.3.110:13043] [client 162.158.3.110] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.dev.local"] [unique_id "acpcPyB2g7BNCXGBOJNqpQAAAQQ"]
[Mon Mar 30 19:19:27.700669 2026] [:error] [pid 11947:tid 11950] [client 162.158.3.98:13192] [client 162.158.3.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.docker"] [unique_id "acpcPzSVtzzXIgk-FglDPgAAAgE"]
[Mon Mar 30 19:19:27.717423 2026] [:error] [pid 11947:tid 11959] [client 162.158.2.166:9815] [client 162.158.2.166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.container"] [unique_id "acpcPzSVtzzXIgk-FglDPwAAAgo"]
[Mon Mar 30 19:19:27.935505 2026] [:error] [pid 12106:tid 12110] [client 162.158.3.94:14256] [client 162.158.3.94] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/docker/.env"] [unique_id "acpcP7IKxOs8TAdw7hcSDwAAAoI"]
[Mon Mar 30 19:19:27.987455 2026] [:error] [pid 64743:tid 64758] [client 162.158.3.120:10800] [client 162.158.3.120] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/docker/.env.local"] [unique_id "acpcPyzmpVL6Ubzil4idqgAAAU0"]
[Mon Mar 30 19:19:27.997669 2026] [:error] [pid 12106:tid 12119] [client 162.158.2.140:9653] [client 162.158.2.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/server/.env"] [unique_id "acpcP7IKxOs8TAdw7hcSEgAAAos"]
[Mon Mar 30 19:19:28.217478 2026] [:error] [pid 35343:tid 35354] [client 162.158.2.166:9817] [client 162.158.2.166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/srv/.env"] [unique_id "acpcQKP5HurqmbvwN-IjLwAAAAk"]
[Mon Mar 30 19:19:28.264200 2026] [:error] [pid 41941:tid 41955] [client 162.158.3.94:14259] [client 162.158.3.94] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/web/.env"] [unique_id "acpcQCB2g7BNCXGBOJNqpgAAAQw"]
[Mon Mar 30 19:19:28.279174 2026] [:error] [pid 41941:tid 41964] [client 162.158.3.120:10805] [client 162.158.3.120] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/site/.env"] [unique_id "acpcQCB2g7BNCXGBOJNqpwAAARU"]
[Mon Mar 30 19:19:28.279352 2026] [:error] [pid 41941:tid 41951] [client 162.158.3.142:12391] [client 162.158.3.142] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/www/.env"] [unique_id "acpcQCB2g7BNCXGBOJNqqAAAAQg"]
[Mon Mar 30 19:19:28.498541 2026] [:error] [pid 12106:tid 12108] [client 162.158.3.102:11018] [client 162.158.3.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/var/www/.env"] [unique_id "acpcQLIKxOs8TAdw7hcSEwAAAoA"]
[Mon Mar 30 19:19:28.548634 2026] [:error] [pid 12106:tid 12129] [client 162.158.2.167:9980] [client 162.158.2.167] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/var/www/html/.env"] [unique_id "acpcQLIKxOs8TAdw7hcSFAAAApU"]
[Mon Mar 30 19:19:28.556976 2026] [:error] [pid 41941:tid 41950] [client 162.158.3.141:10998] [client 162.158.3.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/home/.env"] [unique_id "acpcQCB2g7BNCXGBOJNqqQAAAQc"]
[Mon Mar 30 19:19:28.557539 2026] [:error] [pid 35343:tid 35363] [client 162.158.3.98:13195] [client 162.158.3.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/root/.env"] [unique_id "acpcQKP5HurqmbvwN-IjMQAAABI"]
[Mon Mar 30 19:19:28.785714 2026] [:error] [pid 41941:tid 41958] [client 162.158.3.101:12083] [client 162.158.3.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env_config"] [unique_id "acpcQCB2g7BNCXGBOJNqqwAAAQ8"]
[Mon Mar 30 19:19:28.828591 2026] [:error] [pid 35249:tid 35296] [client 162.158.3.110:13048] [client 162.158.3.110] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env_secret"] [unique_id "acpcQCqCKiTq85d6rgBRbgAAAIw"]
[Mon Mar 30 19:19:28.835457 2026] [:error] [pid 12046:tid 12058] [client 162.158.2.141:12389] [client 162.158.2.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env_settings"] [unique_id "acpcQJDbtlkoJ6ELn7gXOwAAAkk"]
[Mon Mar 30 19:19:28.843574 2026] [:error] [pid 41941:tid 41948] [client 162.158.3.97:10760] [client 162.158.3.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local.backup"] [unique_id "acpcQCB2g7BNCXGBOJNqrAAAAQU"]
[Mon Mar 30 19:19:44.519964 2026] [:error] [pid 35343:tid 35350] [client 162.158.2.166:10039] [client 162.158.2.166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local"] [unique_id "acpcUKP5HurqmbvwN-IjQwAAAAU"]
[Mon Mar 30 19:19:46.568801 2026] [:error] [pid 50663:tid 50676] [client 162.158.2.141:12654] [client 162.158.2.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.json"] [unique_id "acpcUm28b9DKIAMEdfAbEwAAAYs"]
[Mon Mar 30 20:26:28.203209 2026] [:error] [pid 35250:tid 35316] [client 177.73.83.36:49861] [client 177.73.83.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.73.83.36, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acpr9IaKM1MR6zcp2YN06QAAAMU"]
[Tue Mar 31 01:10:29.154185 2026] [:error] [pid 39123:tid 39146] [client 4.205.211.88:5771] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws43.php"] [unique_id "acquhSobgVY20PMQKVtLMAAAARU"]
[Tue Mar 31 01:10:29.873497 2026] [:error] [pid 36939:tid 36949] [client 4.205.211.88:6126] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws43.php"] [unique_id "acquhcRDKH225Jeq1jc00gAAAAg"]
[Tue Mar 31 01:10:30.750106 2026] [:error] [pid 36688:tid 36841] [client 4.205.211.88:5788] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws43.php"] [unique_id "acquhpIe8NBGKiiCIcIF6QAAAIY"]
[Tue Mar 31 01:10:32.013066 2026] [:error] [pid 39123:tid 39134] [client 4.205.211.88:5797] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws43.php"] [unique_id "acquiCobgVY20PMQKVtLOwAAAQk"]
[Tue Mar 31 01:10:32.757186 2026] [:error] [pid 36939:tid 36942] [client 4.205.211.88:5802] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws42.php"] [unique_id "acquiMRDKH225Jeq1jc03gAAAAE"]
[Tue Mar 31 01:10:33.295043 2026] [:error] [pid 36672:tid 36809] [client 4.205.211.88:6082] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws42.php"] [unique_id "acquibKHDzEfeL3XiLo5owAAAEI"]
[Tue Mar 31 01:10:34.160308 2026] [:error] [pid 39123:tid 39139] [client 4.205.211.88:6114] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws42.php"] [unique_id "acquiiobgVY20PMQKVtLSQAAAQ4"]
[Tue Mar 31 01:10:35.842572 2026] [:error] [pid 39123:tid 39145] [client 4.205.211.88:5762] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws42.php"] [unique_id "acquiyobgVY20PMQKVtLTwAAARQ"]
[Tue Mar 31 01:10:36.617497 2026] [:error] [pid 36672:tid 36831] [client 4.205.211.88:5811] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws40.php"] [unique_id "acqujLKHDzEfeL3XiLo5pgAAAFg"]
[Tue Mar 31 01:10:37.612580 2026] [:error] [pid 39123:tid 39134] [client 4.205.211.88:6052] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws40.php"] [unique_id "acqujSobgVY20PMQKVtLWgAAAQk"]
[Tue Mar 31 01:10:38.078781 2026] [:error] [pid 39123:tid 39149] [client 4.205.211.88:5808] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws40.php"] [unique_id "acqujiobgVY20PMQKVtLXQAAARg"]
[Tue Mar 31 01:10:38.581901 2026] [:error] [pid 39123:tid 39132] [client 4.205.211.88:6103] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws40.php"] [unique_id "acqujiobgVY20PMQKVtLYgAAAQc"]
[Tue Mar 31 01:10:39.214374 2026] [:error] [pid 36688:tid 36850] [client 4.205.211.88:6088] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws36.php"] [unique_id "acquj5Ie8NBGKiiCIcIF9QAAAI8"]
[Tue Mar 31 01:10:39.899819 2026] [:error] [pid 36939:tid 36960] [client 4.205.211.88:6085] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws36.php"] [unique_id "acquj8RDKH225Jeq1jc07QAAABM"]
[Tue Mar 31 01:10:40.423886 2026] [:error] [pid 36672:tid 36807] [client 4.205.211.88:5807] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws36.php"] [unique_id "acqukLKHDzEfeL3XiLo5swAAAEA"]
[Tue Mar 31 01:10:41.029878 2026] [:error] [pid 36672:tid 36831] [client 4.205.211.88:5814] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws36.php"] [unique_id "acqukbKHDzEfeL3XiLo5tAAAAFg"]
[Tue Mar 31 01:10:41.939506 2026] [:error] [pid 36688:tid 36856] [client 4.205.211.88:6112] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/vwxbi.php"] [unique_id "acqukZIe8NBGKiiCIcIF-QAAAJU"]
[Tue Mar 31 01:10:42.444935 2026] [:error] [pid 36672:tid 36826] [client 4.205.211.88:5812] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/vwxbi.php"] [unique_id "acqukrKHDzEfeL3XiLo5tgAAAFM"]
[Tue Mar 31 01:10:43.127137 2026] [:error] [pid 39123:tid 39142] [client 4.205.211.88:5776] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/vwxbi.php"] [unique_id "acqukyobgVY20PMQKVtLcAAAARE"]
[Tue Mar 31 01:10:44.540139 2026] [:error] [pid 36688:tid 36842] [client 4.205.211.88:5761] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/vwxbi.php"] [unique_id "acqulJIe8NBGKiiCIcIF_AAAAIc"]
[Tue Mar 31 01:10:45.848821 2026] [:error] [pid 39123:tid 39149] [client 4.205.211.88:6136] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/shellerr.php"] [unique_id "acqulSobgVY20PMQKVtLdgAAARg"]
[Tue Mar 31 01:10:46.567701 2026] [:error] [pid 36688:tid 36851] [client 4.205.211.88:5778] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/shellerr.php"] [unique_id "acqulpIe8NBGKiiCIcIGAAAAAJA"]
[Tue Mar 31 01:10:47.387866 2026] [:error] [pid 36706:tid 36874] [client 4.205.211.88:5765] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/shellerr.php"] [unique_id "acqul7a-eBLL1E34-UXncgAAAMw"]
[Tue Mar 31 01:10:48.457099 2026] [:error] [pid 39123:tid 39140] [client 4.205.211.88:6018] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/shellerr.php"] [unique_id "acqumCobgVY20PMQKVtLfQAAAQ8"]
[Tue Mar 31 01:10:49.154138 2026] [:error] [pid 39123:tid 39146] [client 4.205.211.88:6029] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/vaza.php"] [unique_id "acqumSobgVY20PMQKVtLgAAAARU"]
[Tue Mar 31 01:10:49.864184 2026] [:error] [pid 36688:tid 36858] [client 4.205.211.88:5763] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/vaza.php"] [unique_id "acqumZIe8NBGKiiCIcIGBQAAAJc"]
[Tue Mar 31 01:10:50.589282 2026] [:error] [pid 36939:tid 36945] [client 4.205.211.88:6115] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/vaza.php"] [unique_id "acqumsRDKH225Jeq1jc1BgAAAAQ"]
[Tue Mar 31 01:10:51.121487 2026] [:error] [pid 36939:tid 36948] [client 4.205.211.88:5773] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/vaza.php"] [unique_id "acqum8RDKH225Jeq1jc1CwAAAAc"]
[Tue Mar 31 01:10:51.690814 2026] [:error] [pid 36939:tid 36961] [client 4.205.211.88:6132] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/cvz.php"] [unique_id "acqum8RDKH225Jeq1jc1EAAAABQ"]
[Tue Mar 31 01:10:52.218652 2026] [:error] [pid 39123:tid 39126] [client 4.205.211.88:5809] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/cvz.php"] [unique_id "acqunCobgVY20PMQKVtLgwAAAQE"]
[Tue Mar 31 01:10:52.863053 2026] [:error] [pid 36939:tid 36951] [client 4.205.211.88:6028] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/cvz.php"] [unique_id "acqunMRDKH225Jeq1jc1FAAAAAo"]
[Tue Mar 31 01:10:54.087541 2026] [:error] [pid 36939:tid 36948] [client 4.205.211.88:6095] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/cvz.php"] [unique_id "acqunsRDKH225Jeq1jc1GAAAAAc"]
[Tue Mar 31 01:10:54.883387 2026] [:error] [pid 36706:tid 36864] [client 4.205.211.88:5823] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wtiiy.php"] [unique_id "acqunra-eBLL1E34-UXngQAAAMI"]
[Tue Mar 31 01:10:55.556720 2026] [:error] [pid 36939:tid 36958] [client 4.205.211.88:6116] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wtiiy.php"] [unique_id "acqun8RDKH225Jeq1jc1HwAAABE"]
[Tue Mar 31 01:10:56.114697 2026] [:error] [pid 36939:tid 36945] [client 4.205.211.88:5801] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wtiiy.php"] [unique_id "acquoMRDKH225Jeq1jc1IAAAAAQ"]
[Tue Mar 31 01:10:56.806824 2026] [:error] [pid 36688:tid 36835] [client 4.205.211.88:6113] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wtiiy.php"] [unique_id "acquoJIe8NBGKiiCIcIGGwAAAIA"]
[Tue Mar 31 01:10:57.633111 2026] [:error] [pid 36688:tid 36849] [client 4.205.211.88:5796] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/aee.php"] [unique_id "acquoZIe8NBGKiiCIcIGIAAAAI4"]
[Tue Mar 31 01:10:58.538190 2026] [:error] [pid 36688:tid 36850] [client 4.205.211.88:5810] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/aee.php"] [unique_id "acquopIe8NBGKiiCIcIGIwAAAI8"]
[Tue Mar 31 01:10:59.344050 2026] [:error] [pid 39123:tid 39136] [client 4.205.211.88:6030] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/aee.php"] [unique_id "acquoyobgVY20PMQKVtLhwAAAQs"]
[Tue Mar 31 01:11:00.345912 2026] [:error] [pid 36672:tid 36820] [client 4.205.211.88:6142] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/aee.php"] [unique_id "acqupLKHDzEfeL3XiLo5zgAAAE0"]
[Tue Mar 31 01:11:01.427149 2026] [:error] [pid 36672:tid 36814] [client 4.205.211.88:5777] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sweg.php"] [unique_id "acqupbKHDzEfeL3XiLo50wAAAEc"]
[Tue Mar 31 01:11:02.684705 2026] [:error] [pid 36706:tid 36879] [client 4.205.211.88:5794] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sweg.php"] [unique_id "acqupra-eBLL1E34-UXnjAAAANE"]
[Tue Mar 31 01:11:04.320618 2026] [:error] [pid 39123:tid 39138] [client 4.205.211.88:6030] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sweg.php"] [unique_id "acquqCobgVY20PMQKVtLkAAAAQ0"]
[Tue Mar 31 01:11:04.887200 2026] [:error] [pid 39123:tid 39144] [client 4.205.211.88:5965] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sweg.php"] [unique_id "acquqCobgVY20PMQKVtLlwAAARM"]
[Tue Mar 31 01:11:05.579414 2026] [:error] [pid 39123:tid 39148] [client 4.205.211.88:5968] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sql.php"] [unique_id "acquqSobgVY20PMQKVtLmwAAARc"]
[Tue Mar 31 01:11:06.240351 2026] [:error] [pid 36672:tid 36820] [client 4.205.211.88:5793] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sql.php"] [unique_id "acquqrKHDzEfeL3XiLo51wAAAE0"]
[Tue Mar 31 01:11:06.726516 2026] [:error] [pid 36706:tid 36873] [client 4.205.211.88:6118] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sql.php"] [unique_id "acquqra-eBLL1E34-UXnjwAAAMs"]
[Tue Mar 31 01:11:07.314436 2026] [:error] [pid 36672:tid 36815] [client 4.205.211.88:6124] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sql.php"] [unique_id "acquq7KHDzEfeL3XiLo52QAAAEg"]
[Tue Mar 31 01:11:08.040317 2026] [:error] [pid 36672:tid 36823] [client 4.205.211.88:5779] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sc.php"] [unique_id "acqurLKHDzEfeL3XiLo52wAAAFA"]
[Tue Mar 31 01:11:08.697801 2026] [:error] [pid 36706:tid 36864] [client 4.205.211.88:6049] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sc.php"] [unique_id "acqurLa-eBLL1E34-UXnkgAAAMI"]
[Tue Mar 31 01:11:09.347943 2026] [:error] [pid 36688:tid 36840] [client 4.205.211.88:6137] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sc.php"] [unique_id "acqurZIe8NBGKiiCIcIGMwAAAIU"]
[Tue Mar 31 01:11:09.934623 2026] [:error] [pid 36706:tid 36883] [client 4.205.211.88:6117] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sc.php"] [unique_id "acqurba-eBLL1E34-UXnmgAAANU"]
[Tue Mar 31 01:11:10.720734 2026] [:error] [pid 36688:tid 36839] [client 4.205.211.88:6040] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/eee.php"] [unique_id "acqurpIe8NBGKiiCIcIGOAAAAIQ"]
[Tue Mar 31 01:11:11.316399 2026] [:error] [pid 36672:tid 36817] [client 4.205.211.88:5819] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/eee.php"] [unique_id "acqur7KHDzEfeL3XiLo54gAAAEo"]
[Tue Mar 31 01:11:12.098968 2026] [:error] [pid 39123:tid 39145] [client 4.205.211.88:6110] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/eee.php"] [unique_id "acqusCobgVY20PMQKVtLpQAAARQ"]
[Tue Mar 31 01:11:12.654962 2026] [:error] [pid 36706:tid 36865] [client 4.205.211.88:6129] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/eee.php"] [unique_id "acqusLa-eBLL1E34-UXnqwAAAMM"]
[Tue Mar 31 01:11:13.523452 2026] [:error] [pid 36706:tid 36874] [client 4.205.211.88:5782] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gptsh.php"] [unique_id "acqusba-eBLL1E34-UXntAAAAMw"]
[Tue Mar 31 01:11:14.200325 2026] [:error] [pid 39123:tid 39148] [client 4.205.211.88:5787] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gptsh.php"] [unique_id "acqusiobgVY20PMQKVtLrQAAARc"]
[Tue Mar 31 01:11:14.805719 2026] [:error] [pid 39123:tid 39126] [client 4.205.211.88:6098] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gptsh.php"] [unique_id "acqusiobgVY20PMQKVtLsgAAAQE"]
[Tue Mar 31 01:11:15.299475 2026] [:error] [pid 39123:tid 39140] [client 4.205.211.88:5818] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gptsh.php"] [unique_id "acqusyobgVY20PMQKVtLtgAAAQ8"]
[Tue Mar 31 01:11:15.887228 2026] [:error] [pid 36706:tid 36878] [client 4.205.211.88:6099] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xda.php"] [unique_id "acqus7a-eBLL1E34-UXnuQAAANA"]
[Tue Mar 31 01:11:16.852098 2026] [:error] [pid 36688:tid 36859] [client 4.205.211.88:6042] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xda.php"] [unique_id "acqutJIe8NBGKiiCIcIGWgAAAJg"]
[Tue Mar 31 01:11:17.433411 2026] [:error] [pid 36688:tid 36846] [client 4.205.211.88:5817] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xda.php"] [unique_id "acqutZIe8NBGKiiCIcIGXgAAAIs"]
[Tue Mar 31 01:11:18.062048 2026] [:error] [pid 36672:tid 36821] [client 4.205.211.88:6140] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xda.php"] [unique_id "acqutrKHDzEfeL3XiLo55QAAAE4"]
[Tue Mar 31 01:11:19.132401 2026] [:error] [pid 36706:tid 36869] [client 4.205.211.88:6019] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/roter.php"] [unique_id "acqut7a-eBLL1E34-UXnvQAAAMc"]
[Tue Mar 31 01:11:19.723420 2026] [:error] [pid 39123:tid 39127] [client 4.205.211.88:6043] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/roter.php"] [unique_id "acqutyobgVY20PMQKVtLygAAAQI"]
[Tue Mar 31 01:11:20.199042 2026] [:error] [pid 36939:tid 36957] [client 4.205.211.88:5961] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/roter.php"] [unique_id "acquuMRDKH225Jeq1jc1eQAAABA"]
[Tue Mar 31 01:11:21.010944 2026] [:error] [pid 39123:tid 39132] [client 4.205.211.88:6065] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/roter.php"] [unique_id "acquuSobgVY20PMQKVtL0AAAAQc"]
[Tue Mar 31 01:11:21.887132 2026] [:error] [pid 39123:tid 39127] [client 4.205.211.88:6073] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/size.php"] [unique_id "acquuSobgVY20PMQKVtL0QAAAQI"]
[Tue Mar 31 01:11:22.552830 2026] [:error] [pid 39123:tid 39133] [client 4.205.211.88:6012] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/size.php"] [unique_id "acquuiobgVY20PMQKVtL1QAAAQg"]
[Tue Mar 31 01:11:23.377697 2026] [:error] [pid 36688:tid 36846] [client 4.205.211.88:6051] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/size.php"] [unique_id "acquu5Ie8NBGKiiCIcIGZQAAAIs"]
[Tue Mar 31 01:11:23.950961 2026] [:error] [pid 36706:tid 36881] [client 4.205.211.88:6119] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/size.php"] [unique_id "acquu7a-eBLL1E34-UXnwwAAANM"]
[Tue Mar 31 01:11:24.680374 2026] [:error] [pid 36706:tid 36876] [client 4.205.211.88:6122] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/save.php"] [unique_id "acquvLa-eBLL1E34-UXnxQAAAM4"]
[Tue Mar 31 01:11:25.289672 2026] [:error] [pid 36706:tid 36867] [client 4.205.211.88:6050] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/save.php"] [unique_id "acquvba-eBLL1E34-UXnxgAAAMU"]
[Tue Mar 31 01:11:25.807386 2026] [:error] [pid 36706:tid 36864] [client 4.205.211.88:5781] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/save.php"] [unique_id "acquvba-eBLL1E34-UXnyQAAAMI"]
[Tue Mar 31 01:12:05.185465 2026] [:error] [pid 36939:tid 36955] [client 4.205.211.88:6001] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws77.php"] [unique_id "acqu5cRDKH225Jeq1jc1_gAAAA4"]
[Tue Mar 31 01:12:06.032203 2026] [:error] [pid 39123:tid 39126] [client 4.205.211.88:6111] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws77.php"] [unique_id "acqu5iobgVY20PMQKVtMagAAAQE"]
[Tue Mar 31 01:12:07.289100 2026] [:error] [pid 36939:tid 36962] [client 4.205.211.88:6141] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws77.php"] [unique_id "acqu58RDKH225Jeq1jc2CAAAABU"]
[Tue Mar 31 01:12:07.935185 2026] [:error] [pid 36939:tid 36960] [client 4.205.211.88:5822] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws77.php"] [unique_id "acqu58RDKH225Jeq1jc2DgAAABM"]
[Tue Mar 31 01:12:08.821336 2026] [:error] [pid 39123:tid 39141] [client 4.205.211.88:6143] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws86.php"] [unique_id "acqu6CobgVY20PMQKVtMcwAAARA"]
[Tue Mar 31 01:12:09.801169 2026] [:error] [pid 39123:tid 39126] [client 4.205.211.88:6044] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws86.php"] [unique_id "acqu6SobgVY20PMQKVtMeAAAAQE"]
[Tue Mar 31 01:12:10.709052 2026] [:error] [pid 39123:tid 39139] [client 4.205.211.88:6089] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws86.php"] [unique_id "acqu6iobgVY20PMQKVtMfAAAAQ4"]
[Tue Mar 31 01:12:11.506481 2026] [:error] [pid 36672:tid 36829] [client 4.205.211.88:6101] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws86.php"] [unique_id "acqu67KHDzEfeL3XiLo6IAAAAFY"]
[Tue Mar 31 01:12:12.869828 2026] [:error] [pid 36688:tid 36839] [client 4.205.211.88:5954] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/saorix1.php"] [unique_id "acqu7JIe8NBGKiiCIcIGoQAAAIQ"]
[Tue Mar 31 01:12:14.656218 2026] [:error] [pid 39123:tid 39134] [client 4.205.211.88:6033] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/saorix1.php"] [unique_id "acqu7iobgVY20PMQKVtMkgAAAQk"]
[Tue Mar 31 01:12:16.266528 2026] [:error] [pid 36688:tid 36854] [client 4.205.211.88:6106] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/saorix1.php"] [unique_id "acqu8JIe8NBGKiiCIcIGpwAAAJM"]
[Tue Mar 31 01:12:18.756097 2026] [:error] [pid 39123:tid 39139] [client 4.205.211.88:6135] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/saorix1.php"] [unique_id "acqu8iobgVY20PMQKVtMngAAAQ4"]
[Tue Mar 31 01:12:19.653086 2026] [:error] [pid 36688:tid 36859] [client 4.205.211.88:5963] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-class.php"] [unique_id "acqu85Ie8NBGKiiCIcIGrAAAAJg"]
[Tue Mar 31 01:12:20.332129 2026] [:error] [pid 39123:tid 39144] [client 4.205.211.88:6066] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-class.php"] [unique_id "acqu9CobgVY20PMQKVtMpAAAARM"]
[Tue Mar 31 01:12:21.151601 2026] [:error] [pid 36939:tid 36947] [client 4.205.211.88:5973] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-class.php"] [unique_id "acqu9cRDKH225Jeq1jc2IgAAAAY"]
[Tue Mar 31 01:12:22.102639 2026] [:error] [pid 36672:tid 36823] [client 4.205.211.88:6045] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-class.php"] [unique_id "acqu9rKHDzEfeL3XiLo6KAAAAFA"]
[Tue Mar 31 01:12:23.743778 2026] [:error] [pid 36672:tid 36828] [client 4.205.211.88:6060] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/uuu.php"] [unique_id "acqu97KHDzEfeL3XiLo6KgAAAFU"]
[Tue Mar 31 01:12:25.152812 2026] [:error] [pid 36706:tid 36872] [client 4.205.211.88:6056] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/uuu.php"] [unique_id "acqu-ba-eBLL1E34-UXoJwAAAMo"]
[Tue Mar 31 01:12:26.593633 2026] [:error] [pid 36706:tid 36885] [client 4.205.211.88:5994] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-load.php"] [unique_id "acqu-ra-eBLL1E34-UXoLAAAANc"]
[Tue Mar 31 01:12:28.458956 2026] [:error] [pid 36706:tid 36886] [client 4.205.211.88:6139] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-load.php"] [unique_id "acqu_La-eBLL1E34-UXoNwAAANg"]
[Tue Mar 31 01:12:29.506913 2026] [:error] [pid 39123:tid 39143] [client 4.205.211.88:5772] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-load.php"] [unique_id "acqu_SobgVY20PMQKVtMswAAARI"]
[Tue Mar 31 01:12:31.697944 2026] [:error] [pid 36688:tid 36839] [client 4.205.211.88:5379] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-load.php"] [unique_id "acqu_5Ie8NBGKiiCIcIGxAAAAIQ"]
[Tue Mar 31 01:12:33.884279 2026] [:error] [pid 39123:tid 39132] [client 4.205.211.88:6011] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gpt-sh.php"] [unique_id "acqvASobgVY20PMQKVtMyQAAAQc"]
[Tue Mar 31 01:12:35.149729 2026] [:error] [pid 36706:tid 36868] [client 4.205.211.88:5991] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gpt-sh.php"] [unique_id "acqvA7a-eBLL1E34-UXoRQAAAMY"]
[Tue Mar 31 01:12:35.986349 2026] [:error] [pid 36939:tid 36958] [client 4.205.211.88:6037] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gpt-sh.php"] [unique_id "acqvA8RDKH225Jeq1jc2OwAAABE"]
[Tue Mar 31 01:12:37.082934 2026] [:error] [pid 36706:tid 36870] [client 4.205.211.88:5976] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gpt-sh.php"] [unique_id "acqvBba-eBLL1E34-UXoTAAAAMg"]
[Tue Mar 31 01:12:37.758030 2026] [:error] [pid 39123:tid 39141] [client 4.205.211.88:5770] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bywaf.php"] [unique_id "acqvBSobgVY20PMQKVtM4gAAARA"]
[Tue Mar 31 01:12:38.412080 2026] [:error] [pid 39123:tid 39130] [client 4.205.211.88:5436] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bywaf.php"] [unique_id "acqvBiobgVY20PMQKVtM6QAAAQU"]
[Tue Mar 31 01:12:39.042998 2026] [:error] [pid 36688:tid 36855] [client 4.205.211.88:6109] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bywaf.php"] [unique_id "acqvB5Ie8NBGKiiCIcIGzQAAAJQ"]
[Tue Mar 31 01:12:40.260894 2026] [:error] [pid 36688:tid 36840] [client 4.205.211.88:5959] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bywaf.php"] [unique_id "acqvCJIe8NBGKiiCIcIGzwAAAIU"]
[Tue Mar 31 01:12:41.056651 2026] [:error] [pid 36672:tid 36817] [client 4.205.211.88:5966] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-true.php"] [unique_id "acqvCbKHDzEfeL3XiLo6NgAAAEo"]
[Tue Mar 31 01:12:42.447398 2026] [:error] [pid 39123:tid 39129] [client 4.205.211.88:6057] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-true.php"] [unique_id "acqvCiobgVY20PMQKVtM_QAAAQQ"]
[Tue Mar 31 01:12:43.065595 2026] [:error] [pid 36688:tid 36854] [client 4.205.211.88:5421] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-true.php"] [unique_id "acqvC5Ie8NBGKiiCIcIG1QAAAJM"]
[Tue Mar 31 01:12:43.838974 2026] [:error] [pid 36672:tid 36819] [client 4.205.211.88:5816] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-true.php"] [unique_id "acqvC7KHDzEfeL3XiLo6PAAAAEw"]
[Tue Mar 31 01:12:44.669295 2026] [:error] [pid 36706:tid 36885] [client 4.205.211.88:6077] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/byp8.php"] [unique_id "acqvDLa-eBLL1E34-UXoXwAAANc"]
[Tue Mar 31 01:12:45.271938 2026] [:error] [pid 39123:tid 39147] [client 4.205.211.88:6102] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/byp8.php"] [unique_id "acqvDSobgVY20PMQKVtNBQAAARY"]
[Tue Mar 31 01:12:46.056767 2026] [:error] [pid 36706:tid 36869] [client 4.205.211.88:5983] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/byp8.php"] [unique_id "acqvDra-eBLL1E34-UXoYQAAAMc"]
[Tue Mar 31 01:12:46.536156 2026] [:error] [pid 39123:tid 39139] [client 4.205.211.88:5984] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/byp8.php"] [unique_id "acqvDiobgVY20PMQKVtNBgAAAQ4"]
[Tue Mar 31 01:12:47.444022 2026] [:error] [pid 39123:tid 39128] [client 4.205.211.88:5958] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/tx88.php"] [unique_id "acqvDyobgVY20PMQKVtNCgAAAQM"]
[Tue Mar 31 01:12:48.738965 2026] [:error] [pid 36706:tid 36884] [client 4.205.211.88:5385] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/tx88.php"] [unique_id "acqvELa-eBLL1E34-UXoaQAAANY"]
[Tue Mar 31 01:12:50.124052 2026] [:error] [pid 36688:tid 36845] [client 4.205.211.88:5971] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/tx88.php"] [unique_id "acqvEpIe8NBGKiiCIcIG6gAAAIo"]
[Tue Mar 31 01:12:51.746596 2026] [:error] [pid 36688:tid 36846] [client 4.205.211.88:5970] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/tx88.php"] [unique_id "acqvE5Ie8NBGKiiCIcIG7wAAAIs"]
[Tue Mar 31 01:12:52.780760 2026] [:error] [pid 36939:tid 36956] [client 4.205.211.88:6058] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/tx79.php"] [unique_id "acqvFMRDKH225Jeq1jc2SQAAAA8"]
[Tue Mar 31 01:12:53.759786 2026] [:error] [pid 36688:tid 36849] [client 4.205.211.88:6053] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/tx79.php"] [unique_id "acqvFZIe8NBGKiiCIcIG8gAAAI4"]
[Tue Mar 31 01:12:54.607863 2026] [:error] [pid 36672:tid 36826] [client 4.205.211.88:5969] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/tx79.php"] [unique_id "acqvFrKHDzEfeL3XiLo6TAAAAFM"]
[Tue Mar 31 01:12:55.644573 2026] [:error] [pid 39123:tid 39129] [client 4.205.211.88:6031] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/tx79.php"] [unique_id "acqvFyobgVY20PMQKVtNHwAAAQQ"]
[Tue Mar 31 01:12:57.312302 2026] [:error] [pid 36939:tid 36944] [client 4.205.211.88:6121] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/max.php"] [unique_id "acqvGcRDKH225Jeq1jc2TgAAAAM"]
[Tue Mar 31 01:12:58.730396 2026] [:error] [pid 39123:tid 39139] [client 4.205.211.88:5384] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/max.php"] [unique_id "acqvGiobgVY20PMQKVtNIQAAAQ4"]
[Tue Mar 31 01:12:59.947209 2026] [:error] [pid 36939:tid 36955] [client 4.205.211.88:5989] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/max.php"] [unique_id "acqvG8RDKH225Jeq1jc2WwAAAA4"]
[Tue Mar 31 01:13:00.600775 2026] [:error] [pid 36672:tid 36826] [client 4.205.211.88:6035] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/max.php"] [unique_id "acqvHLKHDzEfeL3XiLo6VwAAAFM"]
[Tue Mar 31 01:13:01.285048 2026] [:error] [pid 36706:tid 36885] [client 4.205.211.88:5377] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/z60.php"] [unique_id "acqvHba-eBLL1E34-UXoiwAAANc"]
[Tue Mar 31 01:13:01.764360 2026] [:error] [pid 36706:tid 36868] [client 4.205.211.88:5380] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/z60.php"] [unique_id "acqvHba-eBLL1E34-UXojwAAAMY"]
[Tue Mar 31 01:13:02.343840 2026] [:error] [pid 36672:tid 36825] [client 4.205.211.88:6009] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/z60.php"] [unique_id "acqvHrKHDzEfeL3XiLo6WAAAAFI"]
[Tue Mar 31 01:13:02.953742 2026] [:error] [pid 36939:tid 36965] [client 4.205.211.88:6063] [client 4.205.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/z60.php"] [unique_id "acqvHsRDKH225Jeq1jc2YQAAABg"]
[Tue Mar 31 03:53:26.306729 2026] [:error] [pid 18332:tid 18373] [client 104.131.74.47:59428] [client 104.131.74.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.131.74.47, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "acrUtr4KXr1F9raS5GR23wAAABg"]
[Tue Mar 31 08:25:28.474573 2026] [:error] [pid 36890:tid 36897] [client 4.204.246.56:24036] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/network.php"] [unique_id "acsUeJ8FASPd_uH8z7c-tQAAAAI"]
[Tue Mar 31 08:25:28.909114 2026] [:error] [pid 36890:tid 36908] [client 4.204.246.56:24016] [client 4.204.246.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.204.246.56, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "acsUeJ8FASPd_uH8z7c-uAAAAA0"]
[Tue Mar 31 08:25:32.087087 2026] [:error] [pid 36890:tid 36916] [client 4.204.246.56:24004] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "acsUfJ8FASPd_uH8z7c-wwAAABU"]
[Tue Mar 31 08:25:37.169625 2026] [:error] [pid 36890:tid 36916] [client 4.204.246.56:24034] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "acsUgZ8FASPd_uH8z7c-ywAAABU"]
[Tue Mar 31 08:25:37.580739 2026] [:error] [pid 36890:tid 36905] [client 4.204.246.56:24048] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "acsUgZ8FASPd_uH8z7c-zgAAAAo"]
[Tue Mar 31 08:25:38.008830 2026] [:error] [pid 36890:tid 36913] [client 4.204.246.56:24029] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "acsUgp8FASPd_uH8z7c-0wAAABI"]
[Tue Mar 31 08:25:41.189991 2026] [:error] [pid 36890:tid 36915] [client 4.204.246.56:24032] [client 4.204.246.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.204.246.56, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "acsUhZ8FASPd_uH8z7c-3QAAABQ"]
[Tue Mar 31 08:25:42.564535 2026] [:error] [pid 36892:tid 36963] [client 4.204.246.56:24542] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/Response/wp-login.php"] [unique_id "acsUhkyj9S4G0ek3O4LEzAAAAIw"]
[Tue Mar 31 08:25:43.428580 2026] [:error] [pid 36892:tid 36953] [client 4.204.246.56:24056] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "acsUh0yj9S4G0ek3O4LE0QAAAII"]
[Tue Mar 31 08:25:43.851942 2026] [:error] [pid 36892:tid 36970] [client 4.204.246.56:24537] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/src/alfa-rex.php"] [unique_id "acsUh0yj9S4G0ek3O4LE1QAAAJM"]
[Tue Mar 31 08:25:45.641079 2026] [:error] [pid 36892:tid 36960] [client 4.204.246.56:24010] [client 4.204.246.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.204.246.56, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/assets/images/wp-login.php"] [unique_id "acsUiUyj9S4G0ek3O4LE2gAAAIk"]
[Tue Mar 31 08:25:46.571663 2026] [:error] [pid 41421:tid 41441] [client 4.204.246.56:24540] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/themes.php"] [unique_id "acsUihSaDjY9kKFtUQBXIwAAARE"]
[Tue Mar 31 08:25:47.937026 2026] [:error] [pid 36891:tid 36924] [client 4.204.246.56:24539] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "acsUi5JhiMaJUqoqfl4tKQAAAEA"]
[Tue Mar 31 08:25:48.352464 2026] [:error] [pid 36891:tid 36934] [client 4.204.246.56:24021] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Content/Type/wp-login.php"] [unique_id "acsUjJJhiMaJUqoqfl4tLAAAAEo"]
[Tue Mar 31 08:25:49.258334 2026] [:error] [pid 36891:tid 36925] [client 4.204.246.56:24032] [client 4.204.246.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.204.246.56, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "acsUjZJhiMaJUqoqfl4tLQAAAEE"]
[Tue Mar 31 08:25:50.158682 2026] [:error] [pid 41421:tid 41438] [client 4.204.246.56:24558] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/about.php"] [unique_id "acsUjhSaDjY9kKFtUQBXMgAAAQ4"]
[Tue Mar 31 08:25:50.578106 2026] [:error] [pid 41421:tid 41436] [client 4.204.246.56:24027] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Content/Type/index.php"] [unique_id "acsUjhSaDjY9kKFtUQBXNwAAAQw"]
[Tue Mar 31 08:25:51.451929 2026] [:error] [pid 41421:tid 41434] [client 4.204.246.56:24557] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "acsUjxSaDjY9kKFtUQBXPwAAAQo"]
[Tue Mar 31 08:25:54.632832 2026] [:error] [pid 36890:tid 36898] [client 4.204.246.56:24570] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Content/Type/alfa-rex.php"] [unique_id "acsUkp8FASPd_uH8z7c-7AAAAAM"]
[Tue Mar 31 08:25:56.432245 2026] [:error] [pid 36891:tid 36930] [client 4.204.246.56:24545] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "acsUlJJhiMaJUqoqfl4tPwAAAEY"]
[Tue Mar 31 08:25:57.314187 2026] [:error] [pid 36982:tid 37008] [client 4.204.246.56:24538] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "acsUlflMmeoQKN0r_GNyZQAAANc"]
[Tue Mar 31 08:25:58.184476 2026] [:error] [pid 41421:tid 41433] [client 4.204.246.56:24535] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/crystal/about.php"] [unique_id "acsUlhSaDjY9kKFtUQBXTQAAAQk"]
[Tue Mar 31 08:25:59.532954 2026] [:error] [pid 41421:tid 41425] [client 4.204.246.56:24477] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acsUlxSaDjY9kKFtUQBXUAAAAQE"]
[Tue Mar 31 08:26:01.310777 2026] [:error] [pid 41421:tid 41447] [client 4.204.246.56:24061] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "acsUmRSaDjY9kKFtUQBXXwAAARc"]
[Tue Mar 31 08:26:01.725623 2026] [:error] [pid 36890:tid 36912] [client 4.204.246.56:24454] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/wp-login.php"] [unique_id "acsUmZ8FASPd_uH8z7c_AAAAABE"]
[Tue Mar 31 09:53:20.234601 2026] [:error] [pid 36982:tid 36996] [client 15.204.12.43:60797] [client 15.204.12.43] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/cidaas-pro-master/composer.json"] [unique_id "acspEPlMmeoQKN0r_GOwUgAAAMs"]
[Tue Mar 31 11:09:33.534019 2026] [:error] [pid 6548:tid 6570] [client 4.204.246.56:37863] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acs67bgIz9HgMl9YwE7e7AAAAVQ"]
[Tue Mar 31 11:09:35.793336 2026] [:error] [pid 41421:tid 41435] [client 4.204.246.56:37864] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/default.php"] [unique_id "acs67xSaDjY9kKFtUQCyngAAAQs"]
[Tue Mar 31 11:09:36.224869 2026] [:error] [pid 36892:tid 36955] [client 4.204.246.56:37778] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/index.php"] [unique_id "acs68Eyj9S4G0ek3O4L5qgAAAIQ"]
[Tue Mar 31 11:09:36.646374 2026] [:error] [pid 36890:tid 36916] [client 4.204.246.56:37833] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/upload/k2l66g.php"] [unique_id "acs68J8FASPd_uH8z7d_ZQAAABU"]
[Tue Mar 31 11:09:37.089971 2026] [:error] [pid 36890:tid 36905] [client 4.204.246.56:37769] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/ad1.php"] [unique_id "acs68Z8FASPd_uH8z7d_ZgAAAAo"]
[Tue Mar 31 11:09:37.515338 2026] [:error] [pid 41421:tid 41447] [client 4.204.246.56:37881] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/wefile.php"] [unique_id "acs68RSaDjY9kKFtUQCyoQAAARc"]
[Tue Mar 31 11:09:37.939800 2026] [:error] [pid 36982:tid 36998] [client 4.204.246.56:37858] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/tanjiro.php"] [unique_id "acs68flMmeoQKN0r_GP00wAAAM0"]
[Tue Mar 31 11:09:38.478837 2026] [:error] [pid 36890:tid 36914] [client 4.204.246.56:37846] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/7logs.php"] [unique_id "acs68p8FASPd_uH8z7d_ZwAAABM"]
[Tue Mar 31 11:09:38.898923 2026] [:error] [pid 36891:tid 36943] [client 4.204.246.56:37851] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/file22.php"] [unique_id "acs68pJhiMaJUqoqfl5WsQAAAFM"]
[Tue Mar 31 11:09:39.329314 2026] [:error] [pid 36982:tid 36990] [client 4.204.246.56:37871] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/inwp.php"] [unique_id "acs68_lMmeoQKN0r_GP03AAAAMU"]
[Tue Mar 31 11:09:39.758298 2026] [:error] [pid 36982:tid 37007] [client 4.204.246.56:37843] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/ca4.php"] [unique_id "acs68_lMmeoQKN0r_GP04AAAANY"]
[Tue Mar 31 11:09:40.180623 2026] [:error] [pid 36892:tid 36962] [client 4.204.246.56:37866] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/nz.php"] [unique_id "acs69Eyj9S4G0ek3O4L5rAAAAIs"]
[Tue Mar 31 11:09:40.593895 2026] [:error] [pid 36982:tid 37001] [client 4.204.246.56:37824] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/bnn_.php"] [unique_id "acs69PlMmeoQKN0r_GP06AAAANA"]
[Tue Mar 31 11:09:41.015759 2026] [:error] [pid 36982:tid 36998] [client 4.204.246.56:37764] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/anz.php"] [unique_id "acs69flMmeoQKN0r_GP06QAAAM0"]
[Tue Mar 31 11:09:41.436466 2026] [:error] [pid 41421:tid 41442] [client 4.204.246.56:37770] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/wen.php"] [unique_id "acs69RSaDjY9kKFtUQCyrQAAARI"]
[Tue Mar 31 11:09:41.859818 2026] [:error] [pid 36982:tid 36990] [client 4.204.246.56:37854] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/file66.php"] [unique_id "acs69flMmeoQKN0r_GP06wAAAMU"]
[Tue Mar 31 11:09:42.306393 2026] [:error] [pid 6548:tid 6572] [client 4.204.246.56:37867] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/kure.php"] [unique_id "acs69rgIz9HgMl9YwE7fBgAAAVY"]
[Tue Mar 31 11:09:42.725018 2026] [:error] [pid 6548:tid 6550] [client 4.204.246.56:37790] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/blnux.php"] [unique_id "acs69rgIz9HgMl9YwE7fDgAAAUA"]
[Tue Mar 31 11:09:43.156890 2026] [:error] [pid 6548:tid 6573] [client 4.204.246.56:37773] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/gaje.php"] [unique_id "acs697gIz9HgMl9YwE7fEgAAAVc"]
[Tue Mar 31 11:09:43.579407 2026] [:error] [pid 41421:tid 41437] [client 4.204.246.56:37841] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/msy.php"] [unique_id "acs69xSaDjY9kKFtUQCytgAAAQ0"]
[Tue Mar 31 11:09:43.997371 2026] [:error] [pid 36890:tid 36904] [client 4.204.246.56:37775] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/fgd.php"] [unique_id "acs6958FASPd_uH8z7d_cQAAAAk"]
[Tue Mar 31 11:09:44.419350 2026] [:error] [pid 41421:tid 41442] [client 4.204.246.56:37877] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/X7T6.php"] [unique_id "acs6-BSaDjY9kKFtUQCyuQAAARI"]
[Tue Mar 31 11:09:44.849003 2026] [:error] [pid 6548:tid 6569] [client 4.204.246.56:37701] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/alog.php"] [unique_id "acs6-LgIz9HgMl9YwE7fFQAAAVM"]
[Tue Mar 31 11:09:45.295378 2026] [:error] [pid 36982:tid 37002] [client 4.204.246.56:37836] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/p.php"] [unique_id "acs6-flMmeoQKN0r_GP0-QAAANE"]
[Tue Mar 31 11:09:45.720283 2026] [:error] [pid 36982:tid 36996] [client 4.204.246.56:37829] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/sef.php"] [unique_id "acs6-flMmeoQKN0r_GP0_QAAAMs"]
[Tue Mar 31 11:09:46.136966 2026] [:error] [pid 6548:tid 6558] [client 4.204.246.56:37874] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/ztv.php"] [unique_id "acs6-rgIz9HgMl9YwE7fFwAAAUg"]
[Tue Mar 31 11:09:46.570112 2026] [:error] [pid 36892:tid 36964] [client 4.204.246.56:37856] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 13"] [hostname "perthactive.com.au"] [uri "/Rk41.php"] [unique_id "acs6-kyj9S4G0ek3O4L5rwAAAI0"]
[Tue Mar 31 11:09:47.026739 2026] [:error] [pid 36982:tid 37004] [client 4.204.246.56:37883] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/network.php"] [unique_id "acs6-_lMmeoQKN0r_GP1AgAAANM"]
[Tue Mar 31 11:09:47.459015 2026] [:error] [pid 41421:tid 41439] [client 4.204.246.56:37774] [client 4.204.246.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.204.246.56, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "acs6-xSaDjY9kKFtUQCyvQAAAQ8"]
[Tue Mar 31 11:09:47.459125 2026] [:error] [pid 41421:tid 41439] [client 4.204.246.56:37774] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "acs6-xSaDjY9kKFtUQCyvQAAAQ8"]
[Tue Mar 31 11:09:47.881927 2026] [:error] [pid 41421:tid 41438] [client 4.204.246.56:37780] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/js/fm.php"] [unique_id "acs6-xSaDjY9kKFtUQCyvgAAAQ4"]
[Tue Mar 31 11:09:48.355652 2026] [:error] [pid 6548:tid 6559] [client 4.204.246.56:37882] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "acs6_LgIz9HgMl9YwE7fGgAAAUk"]
[Tue Mar 31 11:09:48.771146 2026] [:error] [pid 6548:tid 6565] [client 4.204.246.56:37860] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/WordPress/wp-admin/includes/zmFM.php"] [unique_id "acs6_LgIz9HgMl9YwE7fHQAAAU8"]
[Tue Mar 31 11:09:49.226290 2026] [:error] [pid 36892:tid 36958] [client 4.204.246.56:37865] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/default.php"] [unique_id "acs6_Uyj9S4G0ek3O4L5sAAAAIc"]
[Tue Mar 31 11:09:49.642057 2026] [:error] [pid 36891:tid 36942] [client 4.204.246.56:37768] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/ty.php"] [unique_id "acs6_ZJhiMaJUqoqfl5WtgAAAFI"]
[Tue Mar 31 11:09:50.063716 2026] [:error] [pid 36890:tid 36904] [client 4.204.246.56:37762] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/cay-van-phong/filemanager.php"] [unique_id "acs6_p8FASPd_uH8z7d_fAAAAAk"]
[Tue Mar 31 11:09:50.511441 2026] [:error] [pid 36982:tid 36986] [client 4.204.246.56:37880] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "acs6_vlMmeoQKN0r_GP1DgAAAME"]
[Tue Mar 31 11:09:50.936827 2026] [:error] [pid 6548:tid 6569] [client 4.204.246.56:37797] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/seoplugins/index.php"] [unique_id "acs6_rgIz9HgMl9YwE7fJQAAAVM"]
[Tue Mar 31 11:09:51.430323 2026] [:error] [pid 41421:tid 41443] [client 4.204.246.56:37848] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/ini.php"] [unique_id "acs6_xSaDjY9kKFtUQCywQAAARM"]
[Tue Mar 31 11:09:51.845149 2026] [:error] [pid 41421:tid 41444] [client 4.204.246.56:37862] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/libraries/legacy/info.php"] [unique_id "acs6_xSaDjY9kKFtUQCywgAAARQ"]
[Tue Mar 31 11:09:52.309602 2026] [:error] [pid 41421:tid 41429] [client 4.204.246.56:37803] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/include.php"] [unique_id "acs7ABSaDjY9kKFtUQCyxAAAAQU"]
[Tue Mar 31 11:09:52.725943 2026] [:error] [pid 36982:tid 36991] [client 4.204.246.56:37886] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "acs7APlMmeoQKN0r_GP1HQAAAMY"]
[Tue Mar 31 11:09:53.155585 2026] [:error] [pid 41421:tid 41431] [client 4.204.246.56:37792] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/alfa.php"] [unique_id "acs7ARSaDjY9kKFtUQCyxgAAAQc"]
[Tue Mar 31 11:09:53.585782 2026] [:error] [pid 6548:tid 6574] [client 4.204.246.56:37761] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "acs7AbgIz9HgMl9YwE7fKAAAAVg"]
[Tue Mar 31 11:09:54.008896 2026] [:error] [pid 6548:tid 6563] [client 4.204.246.56:37772] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "acs7ArgIz9HgMl9YwE7fKwAAAU0"]
[Tue Mar 31 11:09:54.451098 2026] [:error] [pid 36891:tid 36946] [client 4.204.246.56:37878] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "acs7ApJhiMaJUqoqfl5WuQAAAFY"]
[Tue Mar 31 11:09:54.870399 2026] [:error] [pid 41421:tid 41448] [client 4.204.246.56:37887] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "acs7AhSaDjY9kKFtUQCyywAAARg"]
[Tue Mar 31 11:09:55.293648 2026] [:error] [pid 41421:tid 41440] [client 4.204.246.56:37789] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "acs7AxSaDjY9kKFtUQCyzAAAARA"]
[Tue Mar 31 11:09:55.718097 2026] [:error] [pid 41421:tid 41428] [client 4.204.246.56:37796] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "acs7AxSaDjY9kKFtUQCy0AAAAQQ"]
[Tue Mar 31 11:09:56.136844 2026] [:error] [pid 6548:tid 6556] [client 4.204.246.56:37766] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "acs7BLgIz9HgMl9YwE7fNAAAAUY"]
[Tue Mar 31 11:09:56.606722 2026] [:error] [pid 36891:tid 36944] [client 4.204.246.56:37857] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "acs7BJJhiMaJUqoqfl5WugAAAFQ"]
[Tue Mar 31 11:09:57.019618 2026] [:error] [pid 36982:tid 36992] [client 4.204.246.56:37785] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/install.php"] [unique_id "acs7BflMmeoQKN0r_GP1JgAAAMc"]
[Tue Mar 31 11:09:57.438697 2026] [:error] [pid 41421:tid 41440] [client 4.204.246.56:37765] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/.well-known/link.php"] [unique_id "acs7BRSaDjY9kKFtUQCy2wAAARA"]
[Tue Mar 31 11:09:57.853689 2026] [:error] [pid 36982:tid 36995] [client 4.204.246.56:37760] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "acs7BflMmeoQKN0r_GP1XgAAAMo"]
[Tue Mar 31 11:09:58.270462 2026] [:error] [pid 6548:tid 6556] [client 4.204.246.56:37787] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/index.php"] [unique_id "acs7BrgIz9HgMl9YwE7fOwAAAUY"]
[Tue Mar 31 11:09:58.693330 2026] [:error] [pid 36892:tid 36973] [client 4.204.246.56:37784] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 14"] [hostname "perthactive.com.au"] [uri "/network.php"] [unique_id "acs7Bkyj9S4G0ek3O4L5uQAAAJY"]
[Tue Mar 31 11:09:59.106361 2026] [:error] [pid 36982:tid 36993] [client 4.204.246.56:37710] [client 4.204.246.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.204.246.56, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "acs7B_lMmeoQKN0r_GP1agAAAMg"]
[Tue Mar 31 11:09:59.106423 2026] [:error] [pid 36982:tid 36993] [client 4.204.246.56:37710] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 15"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "acs7B_lMmeoQKN0r_GP1agAAAMg"]
[Tue Mar 31 11:09:59.527406 2026] [:error] [pid 36892:tid 36972] [client 4.204.246.56:37777] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 15"] [hostname "perthactive.com.au"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "acs7B0yj9S4G0ek3O4L5vgAAAJU"]
[Tue Mar 31 11:09:59.945533 2026] [:error] [pid 41421:tid 41445] [client 4.204.246.56:37720] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 15"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/file.php"] [unique_id "acs7BxSaDjY9kKFtUQCy5QAAARU"]
[Tue Mar 31 11:10:00.392947 2026] [:error] [pid 36892:tid 36951] [client 4.204.246.56:37788] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/Response/wp-login.php"] [unique_id "acs7CEyj9S4G0ek3O4L5wwAAAIA"]
[Tue Mar 31 11:10:00.821491 2026] [:error] [pid 6548:tid 6574] [client 4.204.246.56:37721] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 15"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/coffee/alfa-rex.php"] [unique_id "acs7CLgIz9HgMl9YwE7fRwAAAVg"]
[Tue Mar 31 11:10:01.265634 2026] [:error] [pid 36982:tid 36994] [client 4.204.246.56:37779] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "acs7CflMmeoQKN0r_GP1dwAAAMk"]
[Tue Mar 31 11:10:01.694844 2026] [:error] [pid 41421:tid 41437] [client 4.204.246.56:37816] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/src/alfa-rex.php"] [unique_id "acs7CRSaDjY9kKFtUQCy6AAAAQ0"]
[Tue Mar 31 11:10:02.121557 2026] [:error] [pid 36982:tid 36997] [client 4.204.246.56:37717] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 15"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "acs7CvlMmeoQKN0r_GP1eAAAAMw"]
[Tue Mar 31 11:10:02.536856 2026] [:error] [pid 36890:tid 36917] [client 4.204.246.56:37767] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 15"] [hostname "perthactive.com.au"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "acs7Cp8FASPd_uH8z7d_jQAAABY"]
[Tue Mar 31 11:10:02.971174 2026] [:error] [pid 36982:tid 36994] [client 4.204.246.56:37812] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 15"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "acs7CvlMmeoQKN0r_GP1fAAAAMk"]
[Tue Mar 31 11:10:03.396121 2026] [:error] [pid 36892:tid 36971] [client 4.204.246.56:37805] [client 4.204.246.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.204.246.56, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/assets/images/wp-login.php"] [unique_id "acs7C0yj9S4G0ek3O4L5ygAAAJQ"]
[Tue Mar 31 11:10:03.396185 2026] [:error] [pid 36892:tid 36971] [client 4.204.246.56:37805] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 16"] [hostname "perthactive.com.au"] [uri "/assets/images/wp-login.php"] [unique_id "acs7C0yj9S4G0ek3O4L5ygAAAJQ"]
[Tue Mar 31 11:10:03.845891 2026] [:error] [pid 36982:tid 36998] [client 4.204.246.56:37830] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 16"] [hostname "perthactive.com.au"] [uri "/css/xp.php"] [unique_id "acs7C_lMmeoQKN0r_GP1gAAAAM0"]
[Tue Mar 31 11:10:04.270006 2026] [:error] [pid 36891:tid 36940] [client 4.204.246.56:37879] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/themes.php"] [unique_id "acs7DJJhiMaJUqoqfl5WvwAAAFA"]
[Tue Mar 31 11:10:04.708158 2026] [:error] [pid 36982:tid 36986] [client 4.204.246.56:37819] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 16"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "acs7DPlMmeoQKN0r_GP1hgAAAME"]
[Tue Mar 31 11:10:05.140033 2026] [:error] [pid 36982:tid 36995] [client 4.204.246.56:37725] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 16"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/chosen.php"] [unique_id "acs7DflMmeoQKN0r_GP1iAAAAMo"]
[Tue Mar 31 11:10:05.560100 2026] [:error] [pid 36982:tid 36996] [client 4.204.246.56:37718] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "acs7DflMmeoQKN0r_GP1jwAAAMs"]
[Tue Mar 31 11:10:05.977289 2026] [:error] [pid 41421:tid 41438] [client 4.204.246.56:37756] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Content/Type/wp-login.php"] [unique_id "acs7DRSaDjY9kKFtUQCy8gAAAQ4"]
[Tue Mar 31 11:10:06.404314 2026] [:error] [pid 36890:tid 36896] [client 4.204.246.56:37804] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 16"] [hostname "perthactive.com.au"] [uri "/js/style.php"] [unique_id "acs7Dp8FASPd_uH8z7d_kQAAAAE"]
[Tue Mar 31 11:10:06.820131 2026] [:error] [pid 36982:tid 36993] [client 4.204.246.56:37852] [client 4.204.246.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.204.246.56, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "acs7DvlMmeoQKN0r_GP1lAAAAMg"]
[Tue Mar 31 11:10:06.820242 2026] [:error] [pid 36982:tid 36993] [client 4.204.246.56:37852] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "acs7DvlMmeoQKN0r_GP1lAAAAMg"]
[Tue Mar 31 11:10:08.277047 2026] [:error] [pid 36982:tid 36995] [client 4.204.246.56:37649] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/lock.php"] [unique_id "acs7EPlMmeoQKN0r_GP1nAAAAMo"]
[Tue Mar 31 11:10:08.692209 2026] [:error] [pid 36890:tid 36917] [client 4.204.246.56:37748] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/about.php"] [unique_id "acs7EJ8FASPd_uH8z7d_kwAAABY"]
[Tue Mar 31 11:10:09.112501 2026] [:error] [pid 36890:tid 36895] [client 4.204.246.56:37776] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Content/Type/index.php"] [unique_id "acs7EZ8FASPd_uH8z7d_lgAAAAA"]
[Tue Mar 31 11:10:09.531334 2026] [:error] [pid 41421:tid 41434] [client 4.204.246.56:37821] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/.well-known/dropdown.php"] [unique_id "acs7ERSaDjY9kKFtUQCy9gAAAQo"]
[Tue Mar 31 11:10:09.962115 2026] [:error] [pid 36982:tid 36993] [client 4.204.246.56:37844] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "acs7EflMmeoQKN0r_GP1pAAAAMg"]
[Tue Mar 31 11:10:10.409584 2026] [:error] [pid 36982:tid 36998] [client 4.204.246.56:37794] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/readme.php"] [unique_id "acs7EvlMmeoQKN0r_GP1pwAAAM0"]
[Tue Mar 31 11:10:10.836499 2026] [:error] [pid 36982:tid 37005] [client 4.204.246.56:37747] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/edit.php"] [unique_id "acs7EvlMmeoQKN0r_GP1qgAAANQ"]
[Tue Mar 31 11:10:11.251687 2026] [:error] [pid 36982:tid 36998] [client 4.204.246.56:37845] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "acs7E_lMmeoQKN0r_GP1rQAAAM0"]
[Tue Mar 31 11:10:11.667533 2026] [:error] [pid 36982:tid 36989] [client 4.204.246.56:37723] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/wp-admin/wp-admin.php"] [unique_id "acs7E_lMmeoQKN0r_GP1rwAAAMQ"]
[Tue Mar 31 11:10:12.087143 2026] [:error] [pid 41421:tid 41442] [client 4.204.246.56:37835] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/plugins/DaoZM.php"] [unique_id "acs7FBSaDjY9kKFtUQCy-QAAARI"]
[Tue Mar 31 11:10:12.532673 2026] [:error] [pid 36891:tid 36938] [client 4.204.246.56:37859] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/wp-admin/install.php"] [unique_id "acs7FJJhiMaJUqoqfl5WwgAAAE4"]
[Tue Mar 31 11:10:12.965796 2026] [:error] [pid 36892:tid 36955] [client 4.204.246.56:37820] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Content/Type/alfa-rex.php"] [unique_id "acs7FEyj9S4G0ek3O4L5zAAAAIQ"]
[Tue Mar 31 11:10:13.402638 2026] [:error] [pid 36982:tid 37005] [client 4.204.246.56:37818] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/link.php"] [unique_id "acs7FflMmeoQKN0r_GP1uAAAANQ"]
[Tue Mar 31 11:10:13.819125 2026] [:error] [pid 41421:tid 41447] [client 4.204.246.56:37875] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/403.php"] [unique_id "acs7FRSaDjY9kKFtUQCy_QAAARc"]
[Tue Mar 31 11:10:14.249365 2026] [:error] [pid 36982:tid 37005] [client 4.204.246.56:37828] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/plugins.php"] [unique_id "acs7FvlMmeoQKN0r_GP1vgAAANQ"]
[Tue Mar 31 11:10:14.688613 2026] [:error] [pid 36982:tid 37004] [client 4.204.246.56:37827] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "acs7FvlMmeoQKN0r_GP1wQAAANM"]
[Tue Mar 31 11:10:15.109530 2026] [:error] [pid 41421:tid 41426] [client 4.204.246.56:37744] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/plugin.php"] [unique_id "acs7FxSaDjY9kKFtUQCzAQAAAQI"]
[Tue Mar 31 11:10:15.535166 2026] [:error] [pid 41421:tid 41429] [client 4.204.246.56:37868] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "acs7FxSaDjY9kKFtUQCzBQAAAQU"]
[Tue Mar 31 11:10:15.964414 2026] [:error] [pid 6548:tid 6565] [client 4.204.246.56:37834] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/Assets/edit.php"] [unique_id "acs7F7gIz9HgMl9YwE7fbwAAAU8"]
[Tue Mar 31 11:10:16.393041 2026] [:error] [pid 36982:tid 36987] [client 4.204.246.56:37815] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/crystal/about.php"] [unique_id "acs7GPlMmeoQKN0r_GP1xwAAAMI"]
[Tue Mar 31 11:10:16.815530 2026] [:error] [pid 36982:tid 37005] [client 4.204.246.56:37763] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/wp-content/file.php"] [unique_id "acs7GPlMmeoQKN0r_GP1zAAAANQ"]
[Tue Mar 31 11:10:17.233173 2026] [:error] [pid 36982:tid 36987] [client 4.204.246.56:37729] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/.well-known/pkivalidation/log.php"] [unique_id "acs7GflMmeoQKN0r_GP10AAAAMI"]
[Tue Mar 31 11:10:17.663817 2026] [:error] [pid 41421:tid 41447] [client 4.204.246.56:37801] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acs7GRSaDjY9kKFtUQCzCgAAARc"]
[Tue Mar 31 11:10:18.080176 2026] [:error] [pid 6548:tid 6558] [client 4.204.246.56:37884] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/wp-admin/packed.php"] [unique_id "acs7GrgIz9HgMl9YwE7fdAAAAUg"]
[Tue Mar 31 11:10:18.520650 2026] [:error] [pid 36982:tid 36996] [client 4.204.246.56:37825] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/user.php"] [unique_id "acs7GvlMmeoQKN0r_GP12AAAAMs"]
[Tue Mar 31 11:10:18.973384 2026] [:error] [pid 6548:tid 6568] [client 4.204.246.56:37855] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 4.204.246.56 on wp-login.php, counter = 17"] [hostname "perthactive.com.au"] [uri "/about.php"] [unique_id "acs7GrgIz9HgMl9YwE7feQAAAVI"]
[Tue Mar 31 11:10:21.186529 2026] [:error] [pid 36890:tid 36914] [client 4.204.246.56:37737] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "acs7HZ8FASPd_uH8z7d_rwAAABM"]
[Tue Mar 31 11:10:21.626190 2026] [:error] [pid 41421:tid 41442] [client 4.204.246.56:37731] [client 4.204.246.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/wp-login.php"] [unique_id "acs7HRSaDjY9kKFtUQCzEQAAARI"]
[Wed Apr 01 06:45:38.370327 2026] [:error] [pid 23715:tid 23772] [client 196.168.135.205:1729] [client 196.168.135.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.168.135.205, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "acxOkq-REzOruNbiT9xN8QAAAEs"]
[Wed Apr 01 08:57:19.687371 2026] [:error] [pid 23714:tid 23742] [client 20.116.48.67:52168] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acxtb0HxDDU2ETcG9DQtGgAAAAg"]
[Wed Apr 01 08:57:21.107822 2026] [:error] [pid 24314:tid 24341] [client 20.116.48.67:45501] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acxtcZRF3FCzjmMUX5YCQwAAARc"]
[Wed Apr 01 08:57:22.528549 2026] [:error] [pid 24348:tid 24403] [client 20.116.48.67:52165] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acxtcm0Vs69Y5nF1HA8IiwAAAZg"]
[Wed Apr 01 08:57:23.951598 2026] [:error] [pid 24348:tid 24383] [client 20.116.48.67:45499] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acxtc20Vs69Y5nF1HA8IlQAAAYQ"]
[Wed Apr 01 12:16:22.365896 2026] [:error] [pid 23715:tid 23775] [client 20.116.48.67:44966] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/network.php"] [unique_id "acycFq-REzOruNbiT9zAJQAAAE4"]
[Wed Apr 01 12:16:23.791085 2026] [:error] [pid 24348:tid 24394] [client 20.116.48.67:44940] [client 20.116.48.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.116.48.67, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "acycF20Vs69Y5nF1HA9Z_wAAAY8"]
[Wed Apr 01 12:16:34.858171 2026] [:error] [pid 24348:tid 24397] [client 20.116.48.67:44870] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "acycIm0Vs69Y5nF1HA9aFAAAAZI"]
[Wed Apr 01 12:16:52.326402 2026] [:error] [pid 23714:tid 23742] [client 20.116.48.67:44951] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "acycNEHxDDU2ETcG9DTGZAAAAAg"]
[Wed Apr 01 12:16:53.759988 2026] [:error] [pid 24348:tid 24392] [client 20.116.48.67:45015] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "acycNW0Vs69Y5nF1HA9aLgAAAY0"]
[Wed Apr 01 12:16:55.183166 2026] [:error] [pid 23819:tid 23835] [client 20.116.48.67:45042] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "acycN9dfUS_37wFAM75ByQAAAM0"]
[Wed Apr 01 12:17:06.218587 2026] [:error] [pid 24348:tid 24383] [client 20.116.48.67:45039] [client 20.116.48.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.116.48.67, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "acycQm0Vs69Y5nF1HA9aOAAAAYQ"]
[Wed Apr 01 12:17:11.165361 2026] [:error] [pid 23714:tid 23741] [client 20.116.48.67:44815] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/Response/wp-login.php"] [unique_id "acycR0HxDDU2ETcG9DTG8AAAAAc"]
[Wed Apr 01 12:17:14.056094 2026] [:error] [pid 23715:tid 23764] [client 20.116.48.67:45017] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "acycSq-REzOruNbiT9zAWwAAAEM"]
[Wed Apr 01 12:17:15.492451 2026] [:error] [pid 24314:tid 24342] [client 20.116.48.67:45035] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/src/alfa-rex.php"] [unique_id "acycS5RF3FCzjmMUX5YoPQAAARg"]
[Wed Apr 01 12:17:21.374717 2026] [:error] [pid 23714:tid 23751] [client 20.116.48.67:44942] [client 20.116.48.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.116.48.67, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/assets/images/wp-login.php"] [unique_id "acycUUHxDDU2ETcG9DTHBwAAABE"]
[Wed Apr 01 12:17:24.573011 2026] [:error] [pid 23714:tid 23747] [client 20.116.48.67:44959] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/themes.php"] [unique_id "acycVEHxDDU2ETcG9DTHGAAAAA0"]
[Wed Apr 01 12:17:29.206019 2026] [:error] [pid 23714:tid 23749] [client 20.116.48.67:45043] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "acycWUHxDDU2ETcG9DTHJQAAAA8"]
[Wed Apr 01 12:17:30.634519 2026] [:error] [pid 23716:tid 23807] [client 20.116.48.67:45014] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Content/Type/wp-login.php"] [unique_id "acycWnVtFUg_mx-RYb70oAAAAJM"]
[Wed Apr 01 12:17:33.790241 2026] [:error] [pid 23716:tid 23793] [client 20.116.48.67:44969] [client 20.116.48.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.116.48.67, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "acycXXVtFUg_mx-RYb70qgAAAIU"]
[Wed Apr 01 12:17:36.984389 2026] [:error] [pid 23715:tid 23783] [client 20.116.48.67:44867] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/about.php"] [unique_id "acycYK-REzOruNbiT9zAagAAAFY"]
[Wed Apr 01 12:17:38.425208 2026] [:error] [pid 23819:tid 23823] [client 20.116.48.67:44949] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Content/Type/index.php"] [unique_id "acycYtdfUS_37wFAM75B5AAAAME"]
[Wed Apr 01 12:17:41.562027 2026] [:error] [pid 23716:tid 23796] [client 20.116.48.67:45028] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "acycZXVtFUg_mx-RYb70wgAAAIg"]
[Wed Apr 01 12:17:52.057185 2026] [:error] [pid 23716:tid 23790] [client 20.116.48.67:44979] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Content/Type/alfa-rex.php"] [unique_id "acyccHVtFUg_mx-RYb705AAAAII"]
[Wed Apr 01 12:17:58.383436 2026] [:error] [pid 24346:tid 24366] [client 20.116.48.67:44982] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "acycdrc1l8kg9MhGHILZbwAAAU4"]
[Wed Apr 01 12:18:01.538406 2026] [:error] [pid 23819:tid 23832] [client 20.116.48.67:44872] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "acyceddfUS_37wFAM75CBAAAAMo"]
[Wed Apr 01 12:18:04.684840 2026] [:error] [pid 23819:tid 23845] [client 20.116.48.67:44930] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/crystal/about.php"] [unique_id "acycfNdfUS_37wFAM75CEgAAANc"]
[Wed Apr 01 12:18:09.338030 2026] [:error] [pid 23714:tid 23743] [client 20.116.48.67:44967] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acycgUHxDDU2ETcG9DTHhQAAAAk"]
[Wed Apr 01 12:18:15.714189 2026] [:error] [pid 23714:tid 23740] [client 20.116.48.67:44881] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "acych0HxDDU2ETcG9DTHpQAAAAY"]
[Wed Apr 01 12:18:17.155620 2026] [:error] [pid 24348:tid 24382] [client 20.116.48.67:44955] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/wp-login.php"] [unique_id "acyciW0Vs69Y5nF1HA9aqgAAAYM"]
[Wed Apr 01 12:19:00.719932 2026] [autoindex:error] [pid 24348:tid 24387] [client 20.116.48.67:44920] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 01 12:19:02.393332 2026] [:error] [pid 23714:tid 23754] [client 20.116.48.67:44910] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "acyctkHxDDU2ETcG9DTIDwAAABQ"]
[Wed Apr 01 20:43:15.347219 2026] [:error] [pid 17856:tid 17863] [client 185.81.126.92:15394] [client 185.81.126.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.81.126.92, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ac0S4z7Idlm5j9frhqQi7wAAAEU"]
[Thu Apr 02 00:08:27.262187 2026] [:error] [pid 62559:tid 62576] [client 74.248.17.99:64704] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac1C-y7NKI8IaNKZFIcbQQAAAU8"]
[Thu Apr 02 00:08:27.775768 2026] [:error] [pid 62559:tid 62571] [client 74.248.17.99:39055] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac1C-y7NKI8IaNKZFIcbSAAAAUo"]
[Thu Apr 02 00:08:28.302983 2026] [:error] [pid 62559:tid 62585] [client 74.248.17.99:64714] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac1C_C7NKI8IaNKZFIcbTgAAAVg"]
[Thu Apr 02 00:08:28.857990 2026] [:error] [pid 17856:tid 17880] [client 74.248.17.99:42727] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac1C_D7Idlm5j9frhqSMrgAAAFY"]
[Thu Apr 02 07:46:49.058674 2026] [autoindex:error] [pid 37543:tid 37555] [client 40.83.92.30:2523] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 02 07:46:49.505053 2026] [:error] [pid 37543:tid 37562] [client 40.83.92.30:2719] [client 40.83.92.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "ac2uaXhdk2bEYJCvILZFIAAAAVE"]
[Thu Apr 02 09:14:56.922731 2026] [autoindex:error] [pid 54384:tid 54393] [client 164.68.111.175:60001] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Apr 02 19:46:01.378226 2026] [:error] [pid 29467:tid 29479] [client 20.240.235.228:16762] [client 20.240.235.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac5W-b4VUBFCJAq-WOl1sAAAAQk"]
[Thu Apr 02 19:46:01.919529 2026] [:error] [pid 23927:tid 23939] [client 20.240.235.228:16649] [client 20.240.235.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac5W-UsZwqCndhl9uKCq1wAAAYo"]
[Thu Apr 02 19:46:02.488824 2026] [:error] [pid 54384:tid 54403] [client 20.240.235.228:16750] [client 20.240.235.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac5W-tWWpaby3TVN7McMAQAAAdE"]
[Thu Apr 02 19:46:03.044607 2026] [:error] [pid 59194:tid 59231] [client 20.240.235.228:16648] [client 20.240.235.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac5W-xMpAeV11hcQehxDEQAAABI"]
[Fri Apr 03 03:45:37.312305 2026] [:error] [pid 57333:tid 57336] [client 27.34.72.48:26222] [client 27.34.72.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.34.72.48, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ac7HYR43LZe-blRyU9VpLAAAAME"]
[Fri Apr 03 20:42:04.773131 2026] [:error] [pid 40533:tid 40556] [client 45.180.218.177:2273] [client 45.180.218.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.180.218.177, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ac-1nPbIAA8AViDmwsuoNgAAAVU"]
[Fri Apr 03 22:20:23.524017 2026] [:error] [pid 33445:tid 33461] [client 143.198.210.125:56556] [client 143.198.210.125] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "ac_Mp1lRNZ0iDVmJWM0q5QAAAAs"]
[Fri Apr 03 22:20:23.950189 2026] [:error] [pid 40533:tid 40540] [client 143.198.210.125:44906] [client 143.198.210.125] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "ac_Mp_bIAA8AViDmwsvCZAAAAUU"]
[Sat Apr 04 03:27:55.688246 2026] [:error] [pid 12081:tid 12110] [client 216.24.210.159:27341] [client 216.24.210.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "adAUu6MJBCYerZTQdmJByAAAAEo"]
[Sat Apr 04 14:36:08.302554 2026] [:error] [pid 2458:tid 2518] [client 144.76.32.189:64754] [client 144.76.32.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 144.76.32.189, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "adCxWCNozic5SuWqcll2lwAAAE4"]
[Sat Apr 04 15:43:41.219779 2026] [:error] [pid 2459:tid 2546] [client 45.131.195.58:60961] [client 45.131.195.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "adDBLQefyCmu4LR_PlpOWgAAAI4"]
[Sat Apr 04 16:34:51.720085 2026] [:error] [pid 2459:tid 2540] [client 144.76.32.189:56876] [client 144.76.32.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 144.76.32.189, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "adDNKwefyCmu4LR_PlphOgAAAIg"]
[Sat Apr 04 23:40:34.754790 2026] [:error] [pid 2459:tid 2540] [client 20.151.201.236:25451] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "adEw8gefyCmu4LR_Plpl5QAAAIg"]
[Sat Apr 04 23:40:41.523549 2026] [:error] [pid 63487:tid 63494] [client 20.151.201.236:43809] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adEw-WpqOMD5fJ8_5q0_BAAAAUQ"]
[Sat Apr 04 23:40:43.454280 2026] [:error] [pid 37114:tid 37134] [client 20.151.201.236:35757] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "adEw-8-DnSj3fGMexeJibgAAARI"]
[Sat Apr 04 23:40:52.383610 2026] [:error] [pid 63487:tid 63502] [client 20.151.201.236:39977] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "adExBGpqOMD5fJ8_5q0_GQAAAUw"]
[Sat Apr 04 23:40:56.002091 2026] [:error] [pid 63487:tid 63491] [client 20.151.201.236:39976] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/chosen.php"] [unique_id "adExCGpqOMD5fJ8_5q0_MwAAAUE"]
[Sat Apr 04 23:41:13.421899 2026] [:error] [pid 2457:tid 2490] [client 20.151.201.236:13640] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/themes.php"] [unique_id "adExGUmNHppaMd92ZpeMQAAAAA0"]
[Sat Apr 04 23:41:17.057950 2026] [:error] [pid 2457:tid 2487] [client 20.151.201.236:31399] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/wp.php"] [unique_id "adExHUmNHppaMd92ZpeMQgAAAAo"]
[Sat Apr 04 23:41:21.989158 2026] [:error] [pid 63487:tid 63503] [client 20.151.201.236:39994] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "adExIWpqOMD5fJ8_5q0_bQAAAU0"]
[Sat Apr 04 23:41:25.244825 2026] [:error] [pid 63487:tid 63508] [client 20.151.201.236:13682] [client 20.151.201.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.201.236, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "adExJWpqOMD5fJ8_5q0_eQAAAVI"]
[Sat Apr 04 23:41:26.427557 2026] [:error] [pid 63487:tid 63506] [client 20.151.201.236:44435] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adExJmpqOMD5fJ8_5q0_gQAAAVA"]
[Sat Apr 04 23:41:35.630869 2026] [:error] [pid 2458:tid 2504] [client 20.151.201.236:43819] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/wp-login.php"] [unique_id "adExLyNozic5SuWqcllNewAAAEA"]
[Sat Apr 04 23:41:41.164284 2026] [:error] [pid 2567:tid 2592] [client 20.151.201.236:8032] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/network.php"] [unique_id "adExNWJJmfRsTrAKjdRNGwAAANI"]
[Sat Apr 04 23:41:54.031791 2026] [:error] [pid 63487:tid 63507] [client 20.151.201.236:13681] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adExQmpqOMD5fJ8_5q0_zwAAAVE"]
[Sat Apr 04 23:41:57.236847 2026] [:error] [pid 2457:tid 2484] [client 20.151.201.236:25457] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "adExRUmNHppaMd92ZpeMbgAAAAc"]
[Sat Apr 04 23:42:00.072446 2026] [:error] [pid 2567:tid 2591] [client 20.151.201.236:31366] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/wp-login.php"] [unique_id "adExSGJJmfRsTrAKjdRNJAAAANE"]
[Sat Apr 04 23:42:00.765403 2026] [:error] [pid 2567:tid 2580] [client 20.151.201.236:43837] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/about.php"] [unique_id "adExSGJJmfRsTrAKjdRNJQAAAMY"]
[Sun Apr 05 09:13:40.463577 2026] [:error] [pid 45409:tid 45415] [client 172.213.234.56:54235] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/HLA-dd.php"] [unique_id "adG3RNHt_Oyw03gjCNg7uwAAAMQ"]
[Sun Apr 05 09:13:43.689102 2026] [:error] [pid 30921:tid 30940] [client 172.213.234.56:51871] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/HLA-dd.php"] [unique_id "adG3R2FGQVn8Q0ueB26-PgAAARE"]
[Sun Apr 05 09:13:44.710148 2026] [:error] [pid 45409:tid 45422] [client 172.213.234.56:39187] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/HLA-dd.php"] [unique_id "adG3SNHt_Oyw03gjCNg7wwAAAMs"]
[Sun Apr 05 09:13:47.988342 2026] [:error] [pid 45409:tid 45422] [client 172.213.234.56:54260] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/HLA-dd.php"] [unique_id "adG3S9Ht_Oyw03gjCNg71AAAAMs"]
[Sun Apr 05 09:13:49.891016 2026] [:error] [pid 45305:tid 45372] [client 172.213.234.56:52899] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wsc.php"] [unique_id "adG3TejDQjr7aWhjflCzkAAAAIE"]
[Sun Apr 05 09:13:51.834988 2026] [:error] [pid 45305:tid 45377] [client 172.213.234.56:54266] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wsc.php"] [unique_id "adG3T-jDQjr7aWhjflCzoQAAAIY"]
[Sun Apr 05 09:13:53.875881 2026] [:error] [pid 30921:tid 30947] [client 172.213.234.56:22791] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wsc.php"] [unique_id "adG3UWFGQVn8Q0ueB26-TgAAARg"]
[Sun Apr 05 09:13:55.599261 2026] [:error] [pid 30921:tid 30946] [client 172.213.234.56:49729] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wsc.php"] [unique_id "adG3U2FGQVn8Q0ueB26-VQAAARc"]
[Sun Apr 05 09:13:57.472935 2026] [:error] [pid 45305:tid 45394] [client 172.213.234.56:22844] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-lvminl.php"] [unique_id "adG3VejDQjr7aWhjflCzrAAAAJc"]
[Sun Apr 05 09:13:59.912302 2026] [:error] [pid 45409:tid 45431] [client 172.213.234.56:45073] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-lvminl.php"] [unique_id "adG3V9Ht_Oyw03gjCNg8AQAAANQ"]
[Sun Apr 05 09:14:03.958885 2026] [:error] [pid 45303:tid 45319] [client 172.213.234.56:55152] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-lvminl.php"] [unique_id "adG3W7boQ9eViZ4hdnnEcQAAAAI"]
[Sun Apr 05 09:14:13.912540 2026] [:error] [pid 45305:tid 45389] [client 172.213.234.56:49781] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww.php"] [unique_id "adG3ZejDQjr7aWhjflCz-AAAAJI"]
[Sun Apr 05 09:14:21.603715 2026] [:error] [pid 45409:tid 45433] [client 172.213.234.56:45082] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww.php"] [unique_id "adG3bdHt_Oyw03gjCNg8bAAAANY"]
[Sun Apr 05 09:14:23.429739 2026] [:error] [pid 45409:tid 45428] [client 172.213.234.56:51855] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww.php"] [unique_id "adG3b9Ht_Oyw03gjCNg8dgAAANE"]
[Sun Apr 05 09:14:33.645484 2026] [:error] [pid 45303:tid 45317] [client 172.213.234.56:35479] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/dczem.php"] [unique_id "adG3ebboQ9eViZ4hdnnEswAAAAA"]
[Sun Apr 05 09:14:37.801371 2026] [:error] [pid 30921:tid 30924] [client 172.213.234.56:9253] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/dczem.php"] [unique_id "adG3fWFGQVn8Q0ueB26-mwAAAQE"]
[Sun Apr 05 12:21:39.572722 2026] [:error] [pid 45304:tid 45346] [client 217.216.37.56:51289] [client 217.216.37.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "adHjUw5jnqDKKovdRkl3pwAAAEI"]
[Sun Apr 05 12:21:39.784762 2026] [:error] [pid 45305:tid 45390] [client 217.216.37.56:56467] [client 217.216.37.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "adHjU-jDQjr7aWhjflBTlgAAAJM"]
[Sun Apr 05 12:21:40.151412 2026] [:error] [pid 45305:tid 45391] [client 217.216.37.56:60508] [client 217.216.37.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/media/system/js/core.js"] [unique_id "adHjVOjDQjr7aWhjflBTlwAAAJQ"]
[Sun Apr 05 13:29:27.951703 2026] [:error] [pid 45305:tid 45384] [client 69.10.42.26:51505] [client 69.10.42.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "adHzN-jDQjr7aWhjflCHyAAAAI0"]
[Sun Apr 05 15:31:05.447649 2026] [:error] [pid 45409:tid 45427] [client 103.184.104.171:37320] [client 103.184.104.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.184.104.171, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adIPudHt_Oyw03gjCNgp-wAAANA"]
[Sun Apr 05 15:32:01.435022 2026] [:error] [pid 45305:tid 45385] [client 185.127.126.41:54238] [client 185.127.126.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.127.126.41, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adIP8ejDQjr7aWhjflDMngAAAI4"]
[Sun Apr 05 23:37:41.020906 2026] [:error] [pid 45409:tid 45418] [client 74.248.144.66:18443] [client 74.248.144.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tiny.php"] [unique_id "adKBxdHt_Oyw03gjCNiGdgAAAMc"]
[Mon Apr 06 02:50:41.808363 2026] [:error] [pid 51753:tid 51827] [client 98.71.81.8:2039] [client 98.71.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/wp-login.php"] [unique_id "adKvAa3pmp1JkaicYbvUAAAAARA"]
[Mon Apr 06 02:50:43.562004 2026] [:error] [pid 51580:tid 51658] [client 98.71.81.8:1997] [client 98.71.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "adKvA1NFl1NiyNgNZAltMwAAAFM"]
[Mon Apr 06 02:50:44.336196 2026] [:error] [pid 51580:tid 51652] [client 98.71.81.8:2036] [client 98.71.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adKvBFNFl1NiyNgNZAltNgAAAE0"]
[Mon Apr 06 02:50:45.361690 2026] [:error] [pid 51581:tid 51678] [client 98.71.81.8:1939] [client 98.71.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/about.php"] [unique_id "adKvBd4k74fhQLPUy7Fp6wAAAIk"]
[Mon Apr 06 02:50:51.004382 2026] [:error] [pid 51584:tid 51718] [client 98.71.81.8:1938] [client 98.71.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "adKvC8Z4qY_GoNCPARBUyAAAANU"]
[Mon Apr 06 02:50:51.750224 2026] [:error] [pid 51580:tid 51663] [client 98.71.81.8:2045] [client 98.71.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adKvC1NFl1NiyNgNZAltTwAAAFg"]
[Mon Apr 06 02:50:57.776685 2026] [:error] [pid 51753:tid 51821] [client 98.71.81.8:2006] [client 98.71.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adKvEa3pmp1JkaicYbvUPQAAAQo"]
[Mon Apr 06 02:51:03.395194 2026] [:error] [pid 51584:tid 51703] [client 98.71.81.8:1929] [client 98.71.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/about.php"] [unique_id "adKvF8Z4qY_GoNCPARBU8AAAAMY"]
[Mon Apr 06 02:51:04.346044 2026] [:error] [pid 51753:tid 51830] [client 98.71.81.8:2031] [client 98.71.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "adKvGK3pmp1JkaicYbvUUAAAARM"]
[Mon Apr 06 02:51:05.759377 2026] [:error] [pid 51581:tid 51681] [client 98.71.81.8:2043] [client 98.71.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/wp-login.php"] [unique_id "adKvGd4k74fhQLPUy7FqPgAAAIw"]
[Mon Apr 06 02:51:09.858490 2026] [:error] [pid 51580:tid 51645] [client 98.71.81.8:1862] [client 98.71.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adKvHVNFl1NiyNgNZAltegAAAEY"]
[Mon Apr 06 02:51:12.949658 2026] [:error] [pid 51584:tid 51709] [client 98.71.81.8:1936] [client 98.71.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/about.php"] [unique_id "adKvIMZ4qY_GoNCPARBVHQAAAMw"]
[Mon Apr 06 02:51:15.715946 2026] [:error] [pid 51581:tid 51686] [client 98.71.81.8:1924] [client 98.71.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/alfa-rex.php"] [unique_id "adKvI94k74fhQLPUy7FqXQAAAJE"]
[Mon Apr 06 02:51:17.771260 2026] [:error] [pid 51580:tid 51653] [client 98.71.81.8:1987] [client 98.71.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adKvJVNFl1NiyNgNZAltkQAAAE4"]
[Mon Apr 06 05:28:12.230469 2026] [:error] [pid 35686:tid 35709] [client 216.73.216.142:25111] [client 216.73.216.142] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||www.perthactive.com.au|F|5"] [data "REQUEST_HEADERS:User-Agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "www.perthactive.com.au"] [uri "/robots.txt"] [unique_id "adLT7MMKdea6oORd2fxHnQAAAA0"]
[Mon Apr 06 19:21:47.865587 2026] [autoindex:error] [pid 35688:tid 35752] [client 62.197.144.85:36098] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 06 19:21:48.306249 2026] [autoindex:error] [pid 35688:tid 35758] [client 62.197.144.85:36098] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 06 19:21:48.721937 2026] [autoindex:error] [pid 35688:tid 35765] [client 62.197.144.85:36098] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 06 19:21:49.141130 2026] [autoindex:error] [pid 35688:tid 35772] [client 62.197.144.85:36098] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 07 10:57:17.048035 2026] [:error] [pid 12948:tid 12952] [client 217.216.72.68:57468] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/"] [unique_id "adRyjcbeSPAN8LvMqsY3RQAAAQE"]
[Tue Apr 07 10:57:17.158594 2026] [:error] [pid 37598:tid 37678] [client 217.216.72.68:57807] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/"] [unique_id "adRyje9g7q_cV2WhPawTmwAAAJE"]
[Tue Apr 07 10:57:30.504975 2026] [:error] [pid 12948:tid 12967] [client 217.216.72.68:64227] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "adRymsbeSPAN8LvMqsY3qwAAARA"]
[Tue Apr 07 10:57:30.619534 2026] [:error] [pid 12948:tid 12963] [client 217.216.72.68:52429] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adRymsbeSPAN8LvMqsY3sAAAAQw"]
[Tue Apr 07 10:57:46.769725 2026] [:error] [pid 37596:tid 37613] [client 217.216.72.68:61288] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/readme.html"] [unique_id "adRyqqpaAOZHEjRWjP1XjwAAAAc"]
[Tue Apr 07 13:20:47.656116 2026] [:error] [pid 59660:tid 59667] [client 104.131.80.162:58950] [client 104.131.80.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "adSULzp3-oiX2o5bTszJUwAAAcU"]
[Tue Apr 07 13:20:52.366049 2026] [:error] [pid 12948:tid 12975] [client 104.131.80.162:48248] [client 104.131.80.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "adSUNMbeSPAN8LvMqsZVYQAAARg"]
[Tue Apr 07 15:01:45.421514 2026] [:error] [pid 37719:tid 37741] [client 150.228.63.163:1312] [client 150.228.63.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.228.63.163, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adSr2U09Xv52u2xXGLBeAgAAANM"]
[Tue Apr 07 16:58:30.851742 2026] [:error] [pid 59804:tid 59808] [client 216.73.216.142:62912] [client 216.73.216.142] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||perthactive.com.au|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/robots.txt"] [unique_id "adTHNnYVIXiPh5_eJTlYQAAAAgI"]
[Tue Apr 07 18:28:51.235360 2026] [:error] [pid 59660:tid 59672] [client 54.255.192.52:38882] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env"] [unique_id "adTcYzp3-oiX2o5bTsz8mQAAAco"]
[Tue Apr 07 18:28:51.631024 2026] [:error] [pid 37719:tid 37724] [client 54.255.192.52:38894] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.local"] [unique_id "adTcY009Xv52u2xXGLDQ8wAAAMI"]
[Tue Apr 07 18:28:52.024639 2026] [:error] [pid 37597:tid 37645] [client 54.255.192.52:38904] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.production"] [unique_id "adTcZA6uAY0QAy-8EEIUmwAAAEs"]
[Tue Apr 07 18:28:52.415458 2026] [:error] [pid 37719:tid 37739] [client 54.255.192.52:38932] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.staging"] [unique_id "adTcZE09Xv52u2xXGLDQ9QAAANE"]
[Tue Apr 07 18:28:52.812062 2026] [:error] [pid 59660:tid 59681] [client 54.255.192.52:38948] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.development"] [unique_id "adTcZDp3-oiX2o5bTsz8nAAAAdM"]
[Tue Apr 07 18:28:53.204840 2026] [:error] [pid 12948:tid 12970] [client 54.255.192.52:42262] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.test"] [unique_id "adTcZcbeSPAN8LvMqsaTxgAAARM"]
[Tue Apr 07 18:28:53.595015 2026] [:error] [pid 37598:tid 37676] [client 54.255.192.52:42280] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.remote"] [unique_id "adTcZe9g7q_cV2WhPayVMAAAAI8"]
[Tue Apr 07 18:28:53.989435 2026] [:error] [pid 37597:tid 37650] [client 54.255.192.52:42298] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.bak"] [unique_id "adTcZQ6uAY0QAy-8EEIUoQAAAFA"]
[Tue Apr 07 18:28:54.380921 2026] [:error] [pid 37598:tid 37661] [client 54.255.192.52:42310] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.backup"] [unique_id "adTcZu9g7q_cV2WhPayVMwAAAIA"]
[Tue Apr 07 18:28:54.770960 2026] [:error] [pid 59804:tid 59811] [client 54.255.192.52:42334] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.save"] [unique_id "adTcZnYVIXiPh5_eJTl8BQAAAgU"]
[Tue Apr 07 18:28:55.164643 2026] [:error] [pid 59804:tid 59815] [client 54.255.192.52:42342] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.old"] [unique_id "adTcZ3YVIXiPh5_eJTl8CQAAAgk"]
[Tue Apr 07 18:28:55.554844 2026] [:error] [pid 12948:tid 12959] [client 54.255.192.52:42354] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.sample"] [unique_id "adTcZ8beSPAN8LvMqsaTzAAAAQg"]
[Tue Apr 07 18:28:55.944402 2026] [:error] [pid 59804:tid 59808] [client 54.255.192.52:42374] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.example"] [unique_id "adTcZ3YVIXiPh5_eJTl8DAAAAgI"]
[Tue Apr 07 18:28:56.334506 2026] [:error] [pid 59660:tid 59679] [client 54.255.192.52:42404] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.dev"] [unique_id "adTcaDp3-oiX2o5bTsz8owAAAdE"]
[Tue Apr 07 18:28:56.723854 2026] [:error] [pid 59551:tid 59576] [client 54.255.192.52:42424] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.prod"] [unique_id "adTcaF7LN7Ubyqs-sVvTswAAAZc"]
[Tue Apr 07 18:28:57.124749 2026] [:error] [pid 59551:tid 59564] [client 54.255.192.52:42448] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.stage"] [unique_id "adTcaV7LN7Ubyqs-sVvTuAAAAYs"]
[Tue Apr 07 18:28:57.516118 2026] [:error] [pid 59804:tid 59823] [client 54.255.192.52:42468] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.ci"] [unique_id "adTcaXYVIXiPh5_eJTl8FAAAAhE"]
[Tue Apr 07 18:28:57.907543 2026] [:error] [pid 37596:tid 37618] [client 54.255.192.52:42490] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.docker"] [unique_id "adTcaapaAOZHEjRWjP2MWQAAAAw"]
[Tue Apr 07 18:28:58.298683 2026] [:error] [pid 12948:tid 12968] [client 54.255.192.52:42510] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.live"] [unique_id "adTcasbeSPAN8LvMqsaT0AAAARE"]
[Tue Apr 07 18:28:58.688973 2026] [:error] [pid 12948:tid 12960] [client 54.255.192.52:42528] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.preprod"] [unique_id "adTcasbeSPAN8LvMqsaT0gAAAQk"]
[Tue Apr 07 18:28:59.081516 2026] [:error] [pid 59804:tid 59806] [client 54.255.192.52:42538] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.uat"] [unique_id "adTca3YVIXiPh5_eJTl8GgAAAgA"]
[Tue Apr 07 18:28:59.474114 2026] [:error] [pid 37719:tid 37737] [client 54.255.192.52:42568] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.dist"] [unique_id "adTca009Xv52u2xXGLDQ_gAAAM8"]
[Tue Apr 07 18:28:59.864577 2026] [:error] [pid 59551:tid 59555] [client 54.255.192.52:42584] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.swp"] [unique_id "adTca17LN7Ubyqs-sVvTvwAAAYI"]
[Tue Apr 07 18:29:00.263935 2026] [:error] [pid 59804:tid 59822] [client 54.255.192.52:42606] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env~"] [unique_id "adTcbHYVIXiPh5_eJTl8HAAAAhA"]
[Tue Apr 07 18:29:00.659940 2026] [:error] [pid 37597:tid 37647] [client 54.255.192.52:42618] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/app/.env"] [unique_id "adTcbA6uAY0QAy-8EEIUxwAAAE0"]
[Tue Apr 07 18:29:01.050932 2026] [:error] [pid 37598:tid 37678] [client 54.255.192.52:42638] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/apps/.env"] [unique_id "adTcbe9g7q_cV2WhPayVOQAAAJE"]
[Tue Apr 07 18:29:01.445762 2026] [:error] [pid 59551:tid 59561] [client 54.255.192.52:42646] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/api/.env"] [unique_id "adTcbV7LN7Ubyqs-sVvTyQAAAYg"]
[Tue Apr 07 18:29:01.837194 2026] [:error] [pid 59490:tid 59511] [client 54.255.192.52:42654] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/web/.env"] [unique_id "adTcbUcw8OFbiUZ7Rx1UVAAAAVM"]
[Tue Apr 07 18:29:02.250787 2026] [:error] [pid 37598:tid 37661] [client 54.255.192.52:42670] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/site/.env"] [unique_id "adTcbu9g7q_cV2WhPayVPwAAAIA"]
[Tue Apr 07 18:29:02.643274 2026] [:error] [pid 37598:tid 37673] [client 54.255.192.52:42700] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/public/.env"] [unique_id "adTcbu9g7q_cV2WhPayVQAAAAIw"]
[Tue Apr 07 18:29:03.042449 2026] [:error] [pid 59551:tid 59558] [client 54.255.192.52:42710] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/admin/.env"] [unique_id "adTcb17LN7Ubyqs-sVvT0QAAAYU"]
[Tue Apr 07 18:29:03.432437 2026] [:error] [pid 37598:tid 37679] [client 54.255.192.52:40738] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/backend/.env"] [unique_id "adTcb-9g7q_cV2WhPayVQwAAAJI"]
[Tue Apr 07 18:29:03.823129 2026] [:error] [pid 59551:tid 59560] [client 54.255.192.52:40746] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/server/.env"] [unique_id "adTcb17LN7Ubyqs-sVvT1wAAAYc"]
[Tue Apr 07 18:29:04.213081 2026] [:error] [pid 59551:tid 59563] [client 54.255.192.52:40770] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/frontend/.env"] [unique_id "adTccF7LN7Ubyqs-sVvT2QAAAYo"]
[Tue Apr 07 18:29:04.603355 2026] [:error] [pid 59804:tid 59829] [client 54.255.192.52:40792] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/src/.env"] [unique_id "adTccHYVIXiPh5_eJTl8JwAAAhc"]
[Tue Apr 07 18:29:04.992337 2026] [:error] [pid 37596:tid 37616] [client 54.255.192.52:40810] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/core/.env"] [unique_id "adTccKpaAOZHEjRWjP2MXgAAAAo"]
[Tue Apr 07 18:29:05.384631 2026] [:error] [pid 37598:tid 37669] [client 54.255.192.52:40832] [client 54.255.192.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/core/app/.env"] [unique_id "adTcce9g7q_cV2WhPayVRAAAAIg"]
[Tue Apr 07 18:46:42.336847 2026] [:error] [pid 37597:tid 37636] [client 159.89.55.133:58578] [client 159.89.55.133] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "adTgkg6uAY0QAy-8EEIffQAAAEI"]
[Tue Apr 07 18:57:11.995624 2026] [:error] [pid 12948:tid 12968] [client 35.77.46.64:59822] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "adTjB8beSPAN8LvMqsaY9AAAARE"]
[Tue Apr 07 18:57:12.558947 2026] [:error] [pid 37598:tid 37677] [client 35.77.46.64:59836] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local"] [unique_id "adTjCO9g7q_cV2WhPaybkwAAAJA"]
[Tue Apr 07 18:57:13.118648 2026] [:error] [pid 37597:tid 37640] [client 35.77.46.64:59854] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production"] [unique_id "adTjCQ6uAY0QAy-8EEInGgAAAEY"]
[Tue Apr 07 18:57:13.677065 2026] [:error] [pid 37597:tid 37635] [client 35.77.46.64:59860] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.staging"] [unique_id "adTjCQ6uAY0QAy-8EEInHwAAAEE"]
[Tue Apr 07 18:57:14.235646 2026] [:error] [pid 37597:tid 37638] [client 35.77.46.64:59884] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.development"] [unique_id "adTjCg6uAY0QAy-8EEInIQAAAEQ"]
[Tue Apr 07 18:57:14.801772 2026] [:error] [pid 37719:tid 37729] [client 35.77.46.64:59908] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.test"] [unique_id "adTjCk09Xv52u2xXGLDeDQAAAMc"]
[Tue Apr 07 18:57:15.359150 2026] [:error] [pid 59490:tid 59509] [client 35.77.46.64:59932] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.remote"] [unique_id "adTjC0cw8OFbiUZ7Rx1YgAAAAVE"]
[Tue Apr 07 18:57:15.921615 2026] [:error] [pid 59490:tid 59508] [client 35.77.46.64:59944] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.bak"] [unique_id "adTjC0cw8OFbiUZ7Rx1YgQAAAVA"]
[Tue Apr 07 18:57:16.478671 2026] [:error] [pid 59660:tid 59675] [client 35.77.46.64:59952] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.backup"] [unique_id "adTjDDp3-oiX2o5bTswAwwAAAc0"]
[Tue Apr 07 18:57:17.039594 2026] [:error] [pid 59660:tid 59665] [client 35.77.46.64:59968] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.save"] [unique_id "adTjDTp3-oiX2o5bTswAxQAAAcM"]
[Tue Apr 07 18:57:17.596141 2026] [:error] [pid 37597:tid 37643] [client 35.77.46.64:59990] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.old"] [unique_id "adTjDQ6uAY0QAy-8EEInKAAAAEk"]
[Tue Apr 07 18:57:18.156484 2026] [:error] [pid 37719:tid 37742] [client 35.77.46.64:60004] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.sample"] [unique_id "adTjDk09Xv52u2xXGLDeFgAAANQ"]
[Tue Apr 07 18:57:18.714592 2026] [:error] [pid 37719:tid 37731] [client 35.77.46.64:60022] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.example"] [unique_id "adTjDk09Xv52u2xXGLDeGgAAAMk"]
[Tue Apr 07 18:57:19.272563 2026] [:error] [pid 37719:tid 37724] [client 35.77.46.64:60046] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.dev"] [unique_id "adTjD009Xv52u2xXGLDeHgAAAMI"]
[Tue Apr 07 18:57:19.829125 2026] [:error] [pid 37597:tid 37652] [client 35.77.46.64:60066] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.prod"] [unique_id "adTjDw6uAY0QAy-8EEInMAAAAFI"]
[Tue Apr 07 18:57:20.386505 2026] [:error] [pid 12948:tid 12974] [client 35.77.46.64:35184] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.stage"] [unique_id "adTjEMbeSPAN8LvMqsaY_wAAARc"]
[Tue Apr 07 18:57:20.950196 2026] [:error] [pid 37719:tid 37742] [client 35.77.46.64:35200] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.ci"] [unique_id "adTjEE09Xv52u2xXGLDeJAAAANQ"]
[Tue Apr 07 18:57:21.512864 2026] [:error] [pid 37597:tid 37651] [client 35.77.46.64:35214] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.docker"] [unique_id "adTjEQ6uAY0QAy-8EEInNAAAAFE"]
[Tue Apr 07 18:57:22.090497 2026] [:error] [pid 59551:tid 59570] [client 35.77.46.64:35238] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.live"] [unique_id "adTjEl7LN7Ubyqs-sVveFwAAAZE"]
[Tue Apr 07 18:57:22.654063 2026] [:error] [pid 37719:tid 37731] [client 35.77.46.64:35254] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.preprod"] [unique_id "adTjEk09Xv52u2xXGLDeJgAAAMk"]
[Tue Apr 07 18:57:23.212560 2026] [:error] [pid 59551:tid 59569] [client 35.77.46.64:35266] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.uat"] [unique_id "adTjE17LN7Ubyqs-sVveGAAAAZA"]
[Tue Apr 07 18:57:23.771936 2026] [:error] [pid 37598:tid 37670] [client 35.77.46.64:35280] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.dist"] [unique_id "adTjE-9g7q_cV2WhPaybpAAAAIk"]
[Tue Apr 07 18:57:24.329319 2026] [:error] [pid 37597:tid 37650] [client 35.77.46.64:35298] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.swp"] [unique_id "adTjFA6uAY0QAy-8EEInPQAAAFA"]
[Tue Apr 07 18:57:24.893384 2026] [:error] [pid 37597:tid 37651] [client 35.77.46.64:35310] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env~"] [unique_id "adTjFA6uAY0QAy-8EEInQAAAAFE"]
[Tue Apr 07 18:57:25.459357 2026] [:error] [pid 37719:tid 37726] [client 35.77.46.64:35320] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/app/.env"] [unique_id "adTjFU09Xv52u2xXGLDeMwAAAMQ"]
[Tue Apr 07 18:57:26.016302 2026] [:error] [pid 37597:tid 37642] [client 35.77.46.64:35342] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/apps/.env"] [unique_id "adTjFg6uAY0QAy-8EEInSQAAAEg"]
[Tue Apr 07 18:57:26.571032 2026] [:error] [pid 59660:tid 59684] [client 35.77.46.64:35366] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.env"] [unique_id "adTjFjp3-oiX2o5bTswA0AAAAdY"]
[Tue Apr 07 18:57:27.133289 2026] [:error] [pid 59490:tid 59505] [client 35.77.46.64:35386] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/web/.env"] [unique_id "adTjF0cw8OFbiUZ7Rx1YhwAAAU0"]
[Tue Apr 07 18:57:27.697060 2026] [:error] [pid 37597:tid 37643] [client 35.77.46.64:35402] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/site/.env"] [unique_id "adTjFw6uAY0QAy-8EEInVgAAAEk"]
[Tue Apr 07 18:57:28.257175 2026] [:error] [pid 12948:tid 12972] [client 35.77.46.64:35426] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/public/.env"] [unique_id "adTjGMbeSPAN8LvMqsaZAwAAARU"]
[Tue Apr 07 18:57:28.814032 2026] [:error] [pid 59804:tid 59825] [client 35.77.46.64:35450] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/admin/.env"] [unique_id "adTjGHYVIXiPh5_eJTmE-AAAAhM"]
[Tue Apr 07 18:57:29.379890 2026] [:error] [pid 37597:tid 37655] [client 35.77.46.64:35460] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/backend/.env"] [unique_id "adTjGQ6uAY0QAy-8EEInWgAAAFU"]
[Tue Apr 07 18:57:29.938932 2026] [:error] [pid 59804:tid 59817] [client 35.77.46.64:35480] [client 35.77.46.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/server/.env"] [unique_id "adTjGXYVIXiPh5_eJTmE_AAAAgs"]
[Wed Apr 08 09:25:34.748464 2026] [:error] [pid 47626:tid 47675] [client 103.168.67.159:4154] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "adWujqjWI8TWtHx2sdZKNgAAAEc"]
[Wed Apr 08 09:25:35.491447 2026] [:error] [pid 47627:tid 47701] [client 103.168.67.159:4694] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "adWuj3Oljf1Quv_kDjn0twAAAII"]
[Wed Apr 08 09:25:36.209635 2026] [:error] [pid 49984:tid 50006] [client 103.168.67.159:5206] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "adWukOYY_Bz5lRHcJIE-ggAAAVA"]
[Wed Apr 08 09:25:36.910184 2026] [:error] [pid 49984:tid 50002] [client 103.168.67.159:5790] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "adWukOYY_Bz5lRHcJIE-igAAAUw"]
[Wed Apr 08 09:25:37.619688 2026] [:error] [pid 49984:tid 50002] [client 103.168.67.159:6292] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/dashboard"] [unique_id "adWukeYY_Bz5lRHcJIE-nwAAAUw"]
[Wed Apr 08 09:25:38.322839 2026] [:error] [pid 47732:tid 47737] [client 103.168.67.159:6804] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/dashboard"] [unique_id "adWukom4N5QW9Mh7G128SgAAAMM"]
[Wed Apr 08 09:25:39.022023 2026] [:error] [pid 544:tid 549] [client 103.168.67.159:7280] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/dashboard"] [unique_id "adWukzieLKSoiLVA6YfDMQAAAYA"]
[Wed Apr 08 09:25:39.730623 2026] [:error] [pid 47625:tid 47640] [client 103.168.67.159:7740] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/dashboard"] [unique_id "adWukyVuHyNWzZlE8PA3JwAAAAY"]
[Wed Apr 08 10:43:05.898513 2026] [:error] [pid 47627:tid 47723] [client 152.59.149.32:1986] [client 152.59.149.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.149.32, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adXAuXOljf1Quv_kDjkiswAAAJg"]
[Wed Apr 08 13:06:56.315674 2026] [:error] [pid 12385:tid 12407] [client 104.28.152.201:12899] [client 104.28.152.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "adXicCAjtvRQEkLosq3v-AAAABI"]
[Wed Apr 08 13:06:57.748694 2026] [:error] [pid 12453:tid 12468] [client 69.46.65.137:2726] [client 69.46.65.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "adXicRjtW7S6XsLPvrQA0gAAAI0"]
[Wed Apr 08 13:06:59.718996 2026] [:error] [pid 12453:tid 12458] [client 104.238.41.160:52966] [client 104.238.41.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "adXicxjtW7S6XsLPvrQA3QAAAIM"]
[Wed Apr 08 13:07:01.358032 2026] [:error] [pid 12453:tid 12476] [client 104.238.42.244:21806] [client 104.238.42.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "adXidRjtW7S6XsLPvrQA5QAAAJU"]
[Wed Apr 08 13:07:02.236097 2026] [:error] [pid 12453:tid 12460] [client 104.28.152.201:13474] [client 104.28.152.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "adXidhjtW7S6XsLPvrQA7AAAAIU"]
[Wed Apr 08 13:40:16.014103 2026] [:error] [pid 35642:tid 35652] [client 94.130.8.54:37806] [client 94.130.8.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/HEAD"] [unique_id "adXqQA-CqryxdEs5DN8xDQAAAEg"]
[Thu Apr 09 06:02:28.570425 2026] [:error] [pid 20535:tid 20558] [client 212.34.19.149:59384] [client 212.34.19.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.34.19.149, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adbQdAWiD9hWnEUHWdModwAAAA4"]
[Thu Apr 09 08:47:00.965337 2026] [:error] [pid 20537:tid 20603] [client 20.63.32.44:38705] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adb3BMSTjpSeyrxLmN5RHAAAAIU"]
[Thu Apr 09 08:47:01.412949 2026] [:error] [pid 22627:tid 22633] [client 20.63.32.44:38661] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adb3Bfr8glsF_jKQpr6aFwAAAQM"]
[Thu Apr 09 08:47:01.828825 2026] [:error] [pid 22627:tid 22652] [client 20.63.32.44:38667] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adb3Bfr8glsF_jKQpr6aGQAAARY"]
[Thu Apr 09 08:47:02.244284 2026] [:error] [pid 20537:tid 20599] [client 20.63.32.44:38733] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adb3BsSTjpSeyrxLmN5RHwAAAIE"]
[Thu Apr 09 14:46:41.893670 2026] [autoindex:error] [pid 24927:tid 24937] [client 20.215.65.153:29087] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:46:49.823933 2026] [autoindex:error] [pid 24927:tid 24939] [client 20.215.65.153:27546] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:46:56.818161 2026] [:error] [pid 24927:tid 24946] [client 20.215.65.153:29084] [client 20.215.65.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "addLYDXObuzEuw8mNJt7dwAAARA"]
[Thu Apr 09 14:46:58.493944 2026] [autoindex:error] [pid 24927:tid 24932] [client 20.215.65.153:30610] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 20:04:58.136180 2026] [:error] [pid 63331:tid 63341] [client 20.251.195.197:65271] [client 20.251.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Ipv6.php"] [unique_id "adeV6ibKfIYuVjWbE4VOtwAAAcg"]
[Thu Apr 09 20:05:25.901942 2026] [:error] [pid 24515:tid 24520] [client 20.251.195.197:65209] [client 20.251.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "adeWBa1OMnvM2fMnB1ObXwAAAAE"]
[Thu Apr 09 20:05:28.223967 2026] [:error] [pid 24515:tid 24519] [client 20.251.195.197:65275] [client 20.251.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tiny.php"] [unique_id "adeWCK1OMnvM2fMnB1ObaQAAAAA"]
[Fri Apr 10 00:39:01.358583 2026] [autoindex:error] [pid 63331:tid 63349] [client 173.249.30.252:50562] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Apr 10 02:56:17.753933 2026] [:error] [pid 36672:tid 36684] [client 4.206.144.151:65071] [client 4.206.144.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adf2UT99r9VLJsT_o8ijXAAAAMo"]
[Fri Apr 10 02:56:26.659288 2026] [:error] [pid 36398:tid 36445] [client 4.206.144.151:63819] [client 4.206.144.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adf2WuX640wXZwwgfP-AxwAAAFE"]
[Fri Apr 10 04:46:24.729215 2026] [:error] [pid 12576:tid 12662] [client 94.47.0.251:24489] [client 94.47.0.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.47.0.251, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adgQIAZp1JUS4li1QnuoCAAAAI0"]
[Fri Apr 10 06:51:59.789972 2026] [:error] [pid 12685:tid 12691] [client 118.107.44.96:56233] [client 118.107.44.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.perthactive.com.au"] [uri "/"] [unique_id "adgtj88f5ssYShsynaqDHAAAAMQ"]
[Fri Apr 10 06:52:16.636548 2026] [:error] [pid 12685:tid 12698] [client 118.107.44.96:41721] [client 118.107.44.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.107.44.96, incrementing ddos counter"] [hostname "www.perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adgtoM8f5ssYShsynaqDWgAAAMs"], referer: https://www.facebook.com/
[Fri Apr 10 06:52:16.638439 2026] [:error] [pid 12685:tid 12698] [client 118.107.44.96:41721] [client 118.107.44.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adgtoM8f5ssYShsynaqDWgAAAMs"], referer: https://www.facebook.com/
[Fri Apr 10 18:47:51.075811 2026] [autoindex:error] [pid 13102:tid 13167] [client 20.251.36.179:56310] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 10 18:48:01.923725 2026] [autoindex:error] [pid 13189:tid 13203] [client 20.251.36.179:19364] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 10 18:48:10.976589 2026] [:error] [pid 13189:tid 13192] [client 20.251.36.179:38328] [client 20.251.36.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adjVapAxiJKPums3eBB1UwAAAEA"]
[Fri Apr 10 18:48:13.678142 2026] [autoindex:error] [pid 13102:tid 13174] [client 20.251.36.179:30532] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 10 20:14:17.241482 2026] [:error] [pid 13189:tid 13203] [client 159.65.167.144:47700] [client 159.65.167.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "adjpmZAxiJKPums3eBCcNgAAAEs"]
[Fri Apr 10 21:15:29.084378 2026] [:error] [pid 63023:tid 63046] [client 136.158.37.22:33793] [client 136.158.37.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.158.37.22, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adj38aOf5IOzVN1LeZ9xDgAAA1Q"]
[Fri Apr 10 23:21:18.151032 2026] [:error] [pid 13189:tid 13198] [client 159.65.167.144:45340] [client 159.65.167.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "adkVbpAxiJKPums3eBADdAAAAEY"]
[Sat Apr 11 00:37:58.480285 2026] [autoindex:error] [pid 62769:tid 62789] [client 172.213.241.33:59164] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 00:38:09.553892 2026] [autoindex:error] [pid 62884:tid 62901] [client 172.213.241.33:58565] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 00:38:18.053654 2026] [:error] [pid 62884:tid 62901] [client 172.213.241.33:61562] [client 172.213.241.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adkneuUCK1xrhnnmpo2m1QAAAso"]
[Sat Apr 11 00:38:20.501440 2026] [autoindex:error] [pid 62884:tid 62903] [client 172.213.241.33:57308] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:56:39.595368 2026] [:error] [pid 32088:tid 32167] [client 164.68.120.90:54376] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/join-us"] [unique_id "adlV93i-kLhF3DztplAdLAAAAIA"]
[Sat Apr 11 03:56:54.783410 2026] [:error] [pid 32088:tid 32181] [client 164.68.120.90:40862] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/join-us/"] [unique_id "adlWBni-kLhF3DztplAdYQAAAI4"]
[Sat Apr 11 03:59:43.760430 2026] [:error] [pid 2723:tid 2804] [client 164.68.120.90:34214] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "adlWr4Ny3DfGNAwLjcOyDgAAAJg"]
[Sat Apr 11 04:01:11.592753 2026] [:error] [pid 2723:tid 2800] [client 164.68.120.90:39542] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/privacy"] [unique_id "adlXB4Ny3DfGNAwLjcOzQgAAAJQ"]
[Sat Apr 11 04:01:32.302574 2026] [:error] [pid 2721:tid 2735] [client 164.68.120.90:37806] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/privacy-policy"] [unique_id "adlXHDZWWL4OaRcuwkjIxgAAAAk"]
[Sat Apr 11 04:01:46.009683 2026] [:error] [pid 2722:tid 2759] [client 164.68.120.90:39782] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/terms"] [unique_id "adlXKo_R23QDTmaQHyGCxgAAAEY"]
[Sat Apr 11 04:01:59.896920 2026] [:error] [pid 2722:tid 2768] [client 164.68.120.90:52778] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/terms-and-conditions"] [unique_id "adlXN4_R23QDTmaQHyGC6AAAAE8"]
[Sat Apr 11 05:29:14.251145 2026] [autoindex:error] [pid 33173:tid 33259] [client 144.91.97.142:58020] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Apr 11 09:42:46.637536 2026] [:error] [pid 34824:tid 34887] [client 157.15.40.61:60238] [client 157.15.40.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/media/system/js/core.js"] [unique_id "admnFl_rq5TGFWAbVHXeLQAAAYY"]
[Sat Apr 11 13:42:11.075600 2026] [:error] [pid 2297:tid 2324] [client 125.163.62.8:55177] [client 125.163.62.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.163.62.8, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adnfM7XJS-Jji11jZk3MXQAAARc"]
[Sat Apr 11 13:57:28.161771 2026] [:error] [pid 2187:tid 2231] [client 68.186.187.182:50117] [client 68.186.187.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.186.187.182, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adniyA4J29_qQi0FkjiE8AAAAAM"]
[Sat Apr 11 14:11:39.981008 2026] [:error] [pid 2188:tid 2268] [client 157.15.40.61:56819] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/style.php"] [unique_id "adnmG4DhDA-Xtn2nRScJxQAAAMw"]
[Sat Apr 11 14:11:40.305120 2026] [:error] [pid 2297:tid 2311] [client 157.15.40.61:56891] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/style.php"] [unique_id "adnmHLXJS-Jji11jZk3ZpAAAAQo"]
[Sat Apr 11 14:11:42.726854 2026] [:error] [pid 2188:tid 2278] [client 157.15.40.61:57331] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/style.php"] [unique_id "adnmHoDhDA-Xtn2nRScJ9AAAANY"]
[Sat Apr 11 14:11:44.856181 2026] [:error] [pid 2297:tid 2322] [client 157.15.40.61:57713] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/style.php"] [unique_id "adnmILXJS-Jji11jZk3aPgAAARU"]
[Sat Apr 11 14:11:47.297789 2026] [:error] [pid 2188:tid 2277] [client 157.15.40.61:57738] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style.php"] [unique_id "adnmI4DhDA-Xtn2nRScKZwAAANU"]
[Sat Apr 11 14:11:47.552816 2026] [:error] [pid 2188:tid 2260] [client 157.15.40.61:58148] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/chosen.php"] [unique_id "adnmI4DhDA-Xtn2nRScKaQAAAMQ"]
[Sat Apr 11 14:11:47.818876 2026] [:error] [pid 2297:tid 2306] [client 157.15.40.61:58192] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "adnmI7XJS-Jji11jZk3auQAAAQU"]
[Sat Apr 11 14:11:48.075196 2026] [:error] [pid 2297:tid 2316] [client 157.15.40.61:58225] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/flower.php"] [unique_id "adnmJLXJS-Jji11jZk3avQAAAQ8"]
[Sat Apr 11 14:11:48.848796 2026] [:error] [pid 11067:tid 11071] [client 157.15.40.61:58367] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/gifclass.php"] [unique_id "adnmJMW3w7N67R04YCKShQAAAEI"]
[Sat Apr 11 14:11:49.107863 2026] [:error] [pid 2297:tid 2311] [client 157.15.40.61:58417] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bless.php"] [unique_id "adnmJbXJS-Jji11jZk3a5AAAAQo"]
[Sat Apr 11 14:11:49.378074 2026] [:error] [pid 11067:tid 11077] [client 157.15.40.61:58458] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/class-t.api.php"] [unique_id "adnmJcW3w7N67R04YCKSqgAAAEg"]
[Sat Apr 11 14:11:50.645521 2026] [:error] [pid 2186:tid 2205] [client 157.15.40.61:58502] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/blurbs.php"] [unique_id "adnmJsibnOEEvcO8wPL-OQAAAI8"]
[Sat Apr 11 14:11:50.906670 2026] [:error] [pid 2297:tid 2316] [client 157.15.40.61:58833] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/akcc.php"] [unique_id "adnmJrXJS-Jji11jZk3bVQAAAQ8"]
[Sat Apr 11 14:11:51.159750 2026] [:error] [pid 11067:tid 11082] [client 157.15.40.61:58881] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/abcd.php"] [unique_id "adnmJ8W3w7N67R04YCKTAwAAAE0"]
[Sat Apr 11 14:11:51.411967 2026] [:error] [pid 2188:tid 2271] [client 157.15.40.61:58931] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/shelp.php"] [unique_id "adnmJ4DhDA-Xtn2nRScLBwAAAM8"]
[Sat Apr 11 14:11:53.056957 2026] [:error] [pid 2187:tid 2246] [client 157.15.40.61:59258] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cord.php"] [unique_id "adnmKQ4J29_qQi0FkjiJEQAAABI"]
[Sat Apr 11 14:11:53.309677 2026] [:error] [pid 11067:tid 11083] [client 157.15.40.61:59323] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/dex.php"] [unique_id "adnmKcW3w7N67R04YCKTnQAAAE4"]
[Sat Apr 11 14:11:53.583992 2026] [:error] [pid 2186:tid 2193] [client 157.15.40.61:59362] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "adnmKcibnOEEvcO8wPL-ZAAAAIM"]
[Sat Apr 11 14:11:54.854644 2026] [:error] [pid 2186:tid 2205] [client 157.15.40.61:59422] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/file2.php"] [unique_id "adnmKsibnOEEvcO8wPL-dgAAAI8"]
[Sat Apr 11 14:11:56.128055 2026] [:error] [pid 2188:tid 2271] [client 157.15.40.61:59633] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/zwso.php"] [unique_id "adnmLIDhDA-Xtn2nRScLdAAAAM8"]
[Sat Apr 11 14:11:56.394580 2026] [:error] [pid 2187:tid 2245] [client 157.15.40.61:59973] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/zwso.php"] [unique_id "adnmLA4J29_qQi0FkjiJVQAAABE"]
[Sat Apr 11 14:11:56.651791 2026] [:error] [pid 11067:tid 11090] [client 157.15.40.61:60023] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "adnmLMW3w7N67R04YCKU9AAAAFU"]
[Sat Apr 11 14:12:00.204947 2026] [:error] [pid 11067:tid 11078] [client 157.15.40.61:60855] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bolt.php"] [unique_id "adnmMMW3w7N67R04YCKWOQAAAEk"]
[Sat Apr 11 14:12:01.464737 2026] [:error] [pid 2297:tid 2314] [client 157.15.40.61:61124] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/shlo.php"] [unique_id "adnmMbXJS-Jji11jZk3cQgAAAQ0"]
[Sat Apr 11 14:12:01.725246 2026] [:error] [pid 2188:tid 2261] [client 157.15.40.61:61161] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/133.php"] [unique_id "adnmMYDhDA-Xtn2nRScL8wAAAMU"]
[Sat Apr 11 14:12:02.521083 2026] [:error] [pid 11067:tid 11078] [client 157.15.40.61:61300] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ahax.php"] [unique_id "adnmMsW3w7N67R04YCKWpgAAAEk"]
[Sat Apr 11 14:12:05.236063 2026] [:error] [pid 2188:tid 2257] [client 157.15.40.61:62311] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/php8.php"] [unique_id "adnmNYDhDA-Xtn2nRScMUQAAAME"]
[Sat Apr 11 14:12:07.629243 2026] [:error] [pid 2186:tid 2194] [client 157.15.40.61:49669] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/lufix1.php"] [unique_id "adnmN8ibnOEEvcO8wPL_cQAAAIQ"]
[Sat Apr 11 14:12:10.902075 2026] [:error] [pid 11067:tid 11075] [client 157.15.40.61:50398] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/witmm.php"] [unique_id "adnmOsW3w7N67R04YCKXaAAAAEY"]
[Sat Apr 11 14:12:13.257883 2026] [:error] [pid 2188:tid 2263] [client 157.15.40.61:50645] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "adnmPYDhDA-Xtn2nRScMgAAAAMc"]
[Sat Apr 11 14:12:13.908003 2026] [:error] [pid 2187:tid 2240] [client 157.15.40.61:50932] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "adnmPQ4J29_qQi0FkjiKRQAAAAw"]
[Sat Apr 11 14:12:15.180180 2026] [:error] [pid 2297:tid 2316] [client 157.15.40.61:50967] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/index.php"] [unique_id "adnmP7XJS-Jji11jZk3dKwAAAQ8"]
[Sat Apr 11 14:12:24.460781 2026] [:error] [pid 2297:tid 2322] [client 157.15.40.61:52221] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "adnmSLXJS-Jji11jZk3dmAAAARU"]
[Sat Apr 11 14:12:26.376117 2026] [:error] [pid 2297:tid 2319] [client 157.15.40.61:52305] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/222.php"] [unique_id "adnmSrXJS-Jji11jZk3dsgAAARI"]
[Sat Apr 11 14:12:33.310551 2026] [:error] [pid 2188:tid 2256] [client 157.15.40.61:53338] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/files.php"] [unique_id "adnmUYDhDA-Xtn2nRScNGQAAAMA"]
[Sat Apr 11 14:12:33.583075 2026] [:error] [pid 2186:tid 2204] [client 157.15.40.61:53387] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-editor.php"] [unique_id "adnmUcibnOEEvcO8wPIAHAAAAI4"]
[Sun Apr 12 03:42:43.760646 2026] [autoindex:error] [pid 36938:tid 36956] [client 143.110.250.39:64862] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Apr 12 04:09:02.318986 2026] [:error] [pid 17969:tid 18016] [client 20.223.145.95:56371] [client 20.223.145.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Ipv6.php"] [unique_id "adqqXo-vTBFpusgC4zEUgAAAAY8"]
[Sun Apr 12 04:09:28.595254 2026] [:error] [pid 17938:tid 17949] [client 20.223.145.95:55818] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xwx1.php"] [unique_id "adqqeM1jYBgc2ldMZMRFYgAAAQk"]
[Sun Apr 12 04:09:33.584278 2026] [:error] [pid 16146:tid 16171] [client 20.223.145.95:55870] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xwx1.php"] [unique_id "adqqffEpEtAZB6OjXModpwAAANY"]
[Sun Apr 12 04:09:36.297000 2026] [:error] [pid 15978:tid 16091] [client 20.223.145.95:60117] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xwx1.php"] [unique_id "adqqgPCgLfnuYNR-0aN2zwAAAII"]
[Sun Apr 12 04:09:56.096420 2026] [:error] [pid 59495:tid 59501] [client 20.223.145.95:57063] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wgift1.php"] [unique_id "adqqlEEPRF0I2992SJZwjwAAAAE"]
[Sun Apr 12 04:09:58.787943 2026] [:error] [pid 59496:tid 59532] [client 20.223.145.95:57527] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wgift1.php"] [unique_id "adqqllbu-x4YsLNdFTcWFQAAAEQ"]
[Sun Apr 12 04:10:00.102377 2026] [:error] [pid 59496:tid 59535] [client 20.223.145.95:62318] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wgift1.php"] [unique_id "adqqmFbu-x4YsLNdFTcWFwAAAEc"]
[Sun Apr 12 04:10:03.045700 2026] [:error] [pid 59496:tid 59541] [client 20.223.145.95:57056] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wgift1.php"] [unique_id "adqqm1bu-x4YsLNdFTcWHAAAAE0"]
[Sun Apr 12 04:10:05.830663 2026] [:error] [pid 59497:tid 59566] [client 20.223.145.95:57046] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/img.php"] [unique_id "adqqnf-gq3_7XAyhMW_3JQAAAIs"]
[Sun Apr 12 04:10:09.092191 2026] [:error] [pid 59495:tid 59503] [client 20.223.145.95:57036] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/img.php"] [unique_id "adqqoUEPRF0I2992SJZwoAAAAAM"]
[Sun Apr 12 04:10:13.650585 2026] [:error] [pid 59587:tid 59589] [client 20.223.145.95:60115] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/img.php"] [unique_id "adqqpQ5_bS6XXb06eji_IwAAAMA"]
[Sun Apr 12 04:10:20.007885 2026] [:error] [pid 59587:tid 59605] [client 20.223.145.95:57026] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/new3.php"] [unique_id "adqqrA5_bS6XXb06eji_LQAAAM4"]
[Sun Apr 12 04:10:24.766579 2026] [:error] [pid 59496:tid 59549] [client 20.223.145.95:57522] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/new3.php"] [unique_id "adqqsFbu-x4YsLNdFTcWPAAAAFU"]
[Sun Apr 12 04:10:45.518710 2026] [:error] [pid 59497:tid 59569] [client 20.223.145.95:57496] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ayk.php"] [unique_id "adqqxf-gq3_7XAyhMW_3egAAAI4"]
[Sun Apr 12 04:10:49.311901 2026] [:error] [pid 59496:tid 59529] [client 20.223.145.95:59746] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ayk.php"] [unique_id "adqqyVbu-x4YsLNdFTcWbAAAAEE"]
[Sun Apr 12 04:10:51.601712 2026] [:error] [pid 59497:tid 59574] [client 20.223.145.95:62278] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ayk.php"] [unique_id "adqqy_-gq3_7XAyhMW_3hAAAAJM"]
[Sun Apr 12 04:10:54.027482 2026] [:error] [pid 59496:tid 59549] [client 20.223.145.95:63296] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ayk.php"] [unique_id "adqqzlbu-x4YsLNdFTcWdgAAAFU"]
[Sun Apr 12 04:10:56.954391 2026] [:error] [pid 59496:tid 59552] [client 20.223.145.95:62304] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/red.php"] [unique_id "adqq0Fbu-x4YsLNdFTcWegAAAFg"]
[Sun Apr 12 04:11:01.862672 2026] [:error] [pid 59495:tid 59502] [client 20.223.145.95:56354] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/red.php"] [unique_id "adqq1UEPRF0I2992SJZwzgAAAAI"]
[Sun Apr 12 04:11:04.235693 2026] [:error] [pid 59495:tid 59509] [client 20.223.145.95:55840] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/red.php"] [unique_id "adqq2EEPRF0I2992SJZw0QAAAAk"]
[Sun Apr 12 04:11:05.625024 2026] [:error] [pid 59497:tid 59572] [client 20.223.145.95:55850] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/red.php"] [unique_id "adqq2f-gq3_7XAyhMW_3kAAAAJE"]
[Sun Apr 12 04:11:06.512045 2026] [:error] [pid 59587:tid 59591] [client 20.223.145.95:60125] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ss.php"] [unique_id "adqq2g5_bS6XXb06eji_eQAAAMI"]
[Sun Apr 12 04:11:11.640727 2026] [:error] [pid 59587:tid 59608] [client 20.223.145.95:60152] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ss.php"] [unique_id "adqq3w5_bS6XXb06eji_iQAAANE"]
[Sun Apr 12 04:11:13.388073 2026] [:error] [pid 59495:tid 59520] [client 20.223.145.95:57495] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ss.php"] [unique_id "adqq4UEPRF0I2992SJZw5AAAABQ"]
[Sun Apr 12 04:11:15.622840 2026] [:error] [pid 59587:tid 59596] [client 20.223.145.95:56378] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ss.php"] [unique_id "adqq4w5_bS6XXb06eji_lQAAAMc"]
[Sun Apr 12 04:11:23.942092 2026] [:error] [pid 59495:tid 59524] [client 20.223.145.95:4725] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sadcut1.php"] [unique_id "adqq60EPRF0I2992SJZxNgAAABg"]
[Sun Apr 12 04:11:25.145782 2026] [:error] [pid 59587:tid 59592] [client 20.223.145.95:62320] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sadcut1.php"] [unique_id "adqq7Q5_bS6XXb06ejjABAAAAMM"]
[Sun Apr 12 04:11:57.034489 2026] [:error] [pid 59497:tid 59567] [client 20.223.145.95:55829] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xs.php"] [unique_id "adqrDf-gq3_7XAyhMW_4gQAAAIw"]
[Sun Apr 12 04:11:58.636472 2026] [:error] [pid 59587:tid 59602] [client 20.223.145.95:55811] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xs.php"] [unique_id "adqrDg5_bS6XXb06ejjAJwAAAMs"]
[Sun Apr 12 04:12:00.821339 2026] [:error] [pid 59497:tid 59569] [client 20.223.145.95:57530] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xs.php"] [unique_id "adqrEP-gq3_7XAyhMW_4jQAAAI4"]
[Sun Apr 12 04:12:03.518914 2026] [:error] [pid 59496:tid 59549] [client 20.223.145.95:60106] [client 20.223.145.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "adqrE1bu-x4YsLNdFTcW4AAAAFU"]
[Sun Apr 12 04:12:06.818826 2026] [:error] [pid 59497:tid 59571] [client 20.223.145.95:60107] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/pp.php"] [unique_id "adqrFv-gq3_7XAyhMW_4owAAAJA"]
[Sun Apr 12 04:12:07.818924 2026] [:error] [pid 59587:tid 59594] [client 20.223.145.95:62319] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/pp.php"] [unique_id "adqrFw5_bS6XXb06ejjAMgAAAMU"]
[Sun Apr 12 04:12:08.947389 2026] [:error] [pid 59587:tid 59608] [client 20.223.145.95:60144] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/pp.php"] [unique_id "adqrGA5_bS6XXb06ejjANQAAANE"]
[Sun Apr 12 04:12:11.989290 2026] [:error] [pid 59587:tid 59595] [client 20.223.145.95:57485] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/myy.php"] [unique_id "adqrGw5_bS6XXb06ejjAOAAAAMY"]
[Sun Apr 12 04:12:15.361820 2026] [:error] [pid 59497:tid 59579] [client 20.223.145.95:55843] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/myy.php"] [unique_id "adqrH_-gq3_7XAyhMW_4vgAAAJg"]
[Sun Apr 12 04:12:18.498821 2026] [:error] [pid 62342:tid 62355] [client 20.223.145.95:56366] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/myy.php"] [unique_id "adqrImUSc31Ex2QtFIkvtgAAAQo"]
[Sun Apr 12 04:12:21.825743 2026] [:error] [pid 62342:tid 62352] [client 20.223.145.95:55813] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/myy.php"] [unique_id "adqrJWUSc31Ex2QtFIkv6QAAAQc"]
[Sun Apr 12 04:12:24.347342 2026] [:error] [pid 59587:tid 59609] [client 20.223.145.95:56358] [client 20.223.145.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tiny.php"] [unique_id "adqrKA5_bS6XXb06ejjAUgAAANI"]
[Sun Apr 12 04:12:27.705047 2026] [:error] [pid 62342:tid 62357] [client 20.223.145.95:62334] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wdone1.php"] [unique_id "adqrK2USc31Ex2QtFIkv7gAAAQw"]
[Sun Apr 12 04:12:31.187153 2026] [:error] [pid 59497:tid 59556] [client 20.223.145.95:57062] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wdone1.php"] [unique_id "adqrL_-gq3_7XAyhMW_42gAAAIE"]
[Sun Apr 12 04:12:35.045001 2026] [:error] [pid 59587:tid 59611] [client 20.223.145.95:55848] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wdone1.php"] [unique_id "adqrMw5_bS6XXb06ejjAXAAAANQ"]
[Sun Apr 12 04:12:44.251635 2026] [:error] [pid 59496:tid 59540] [client 20.223.145.95:57518] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xff.php"] [unique_id "adqrPFbu-x4YsLNdFTcW_wAAAEw"]
[Sun Apr 12 04:12:46.202938 2026] [:error] [pid 59495:tid 59514] [client 20.223.145.95:65090] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xff.php"] [unique_id "adqrPkEPRF0I2992SJZxrQAAAA4"]
[Sun Apr 12 04:12:51.982391 2026] [:error] [pid 59587:tid 59606] [client 20.223.145.95:57038] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wsheet1.php"] [unique_id "adqrQw5_bS6XXb06ejjAcQAAAM8"]
[Sun Apr 12 04:13:07.506172 2026] [:error] [pid 59496:tid 59537] [client 20.223.145.95:56348] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/awh.php"] [unique_id "adqrU1bu-x4YsLNdFTcXEwAAAEk"]
[Sun Apr 12 04:13:09.965506 2026] [:error] [pid 59497:tid 59558] [client 20.223.145.95:60122] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/awh.php"] [unique_id "adqrVf-gq3_7XAyhMW_5JgAAAIM"]
[Sun Apr 12 04:13:12.042791 2026] [:error] [pid 59495:tid 59523] [client 20.223.145.95:60108] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/awh.php"] [unique_id "adqrWEEPRF0I2992SJZxyQAAABc"]
[Sun Apr 12 04:13:20.409340 2026] [:error] [pid 59587:tid 59589] [client 20.223.145.95:56333] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/r2.php"] [unique_id "adqrYA5_bS6XXb06ejjAlQAAAMA"]
[Sun Apr 12 04:13:21.547172 2026] [:error] [pid 59496:tid 59534] [client 20.223.145.95:63335] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/r2.php"] [unique_id "adqrYVbu-x4YsLNdFTcXJAAAAEY"]
[Sun Apr 12 04:13:23.705340 2026] [:error] [pid 59496:tid 59532] [client 20.223.145.95:63336] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/r2.php"] [unique_id "adqrY1bu-x4YsLNdFTcXLQAAAEQ"]
[Sun Apr 12 04:13:26.555831 2026] [:error] [pid 59587:tid 59591] [client 20.223.145.95:55816] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/r2.php"] [unique_id "adqrZg5_bS6XXb06ejjAnQAAAMI"]
[Sun Apr 12 04:13:27.903372 2026] [:error] [pid 59587:tid 59604] [client 20.223.145.95:57068] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/2.php"] [unique_id "adqrZw5_bS6XXb06ejjApgAAAM0"]
[Sun Apr 12 04:13:51.271006 2026] [:error] [pid 59497:tid 59573] [client 20.223.145.95:62295] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/db.php"] [unique_id "adqrf_-gq3_7XAyhMW_5dwAAAJI"]
[Sun Apr 12 04:13:56.001926 2026] [:error] [pid 59497:tid 59563] [client 20.223.145.95:55822] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/db.php"] [unique_id "adqrhP-gq3_7XAyhMW_5fgAAAIg"]
[Sun Apr 12 04:13:57.314853 2026] [:error] [pid 59587:tid 59604] [client 20.223.145.95:57476] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class-wp-image.php"] [unique_id "adqrhQ5_bS6XXb06ejjAyAAAAM0"]
[Sun Apr 12 04:13:59.756033 2026] [:error] [pid 59496:tid 59529] [client 20.223.145.95:65107] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class-wp-image.php"] [unique_id "adqrh1bu-x4YsLNdFTcXQgAAAEE"]
[Sun Apr 12 04:14:03.940929 2026] [:error] [pid 59496:tid 59544] [client 20.223.145.95:55866] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class-wp-image.php"] [unique_id "adqri1bu-x4YsLNdFTcXSwAAAFA"]
[Sun Apr 12 04:17:29.889278 2026] [proxy_fcgi:error] [pid 25327:tid 25360] [client 20.220.11.224:40849] AH01071: Got error 'PHP message: PHP Fatal error: Uncaught Error: Undefined constant "ABSPATH" in /home/perthactivecom/public_html/wp-settings.php:33\nStack trace:\n#0 {main}\n thrown in /home/perthactivecom/public_html/wp-settings.php on line 33'
[Sun Apr 12 04:18:15.901533 2026] [:error] [pid 25437:tid 25454] [client 20.220.11.224:40846] [client 20.220.11.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/niil.php"] [unique_id "adqsh3f97wYZje1ep_M37QAAAM8"]
[Sun Apr 12 04:18:18.788502 2026] [:error] [pid 25437:tid 25450] [client 20.220.11.224:40889] [client 20.220.11.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/src/Core/Curve25519-items.php"] [unique_id "adqsinf97wYZje1ep_M3_AAAAMs"]
[Sun Apr 12 04:18:52.955042 2026] [proxy_fcgi:error] [pid 25437:tid 25442] [client 20.220.11.224:40861] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 04:18:53.177753 2026] [proxy_fcgi:error] [pid 25437:tid 25456] [client 20.220.11.224:40861] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 04:20:01.620668 2026] [:error] [pid 25329:tid 25378] [client 20.220.11.224:40953] [client 20.220.11.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/pomo.php"] [unique_id "adqs8WdcIYsS8Iyaj10YpwAAAII"]
[Sun Apr 12 08:22:01.213103 2026] [:error] [pid 25327:tid 25355] [client 20.220.147.82:16957] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adrlqS6h2tZEVJo9JFJmNQAAABM"]
[Sun Apr 12 08:22:01.878134 2026] [:error] [pid 25328:tid 25405] [client 20.220.147.82:16955] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adrlqcxUaQZxT-e0YsAijwAAAFc"]
[Sun Apr 12 08:22:02.382308 2026] [:error] [pid 26599:tid 26610] [client 20.220.147.82:17362] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adrlqnG89LXoQbk_rwByVAAAAUg"]
[Sun Apr 12 08:22:02.867027 2026] [:error] [pid 26600:tid 26652] [client 20.220.147.82:16958] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adrlqu1YwAZiXhQKLYqcIQAAAZc"]
[Sun Apr 12 11:55:42.118085 2026] [:error] [pid 26567:tid 26591] [client 118.185.6.37:54446] [client 118.185.6.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.185.6.37, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adsXvnhRpg6ptWFyFx1ajAAAARY"]
[Sun Apr 12 12:18:09.915457 2026] [:error] [pid 26567:tid 26575] [client 20.223.145.95:4804] [client 20.223.145.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "adsdAXhRpg6ptWFyFx1fbAAAAQY"]
[Sun Apr 12 12:18:11.498348 2026] [:error] [pid 26599:tid 26614] [client 20.223.145.95:61187] [client 20.223.145.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tiny.php"] [unique_id "adsdA3G89LXoQbk_rwCX8QAAAUw"]
[Sun Apr 12 15:57:21.191904 2026] [:error] [pid 25328:tid 25365] [client 189.135.223.140:32349] [client 189.135.223.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.135.223.140, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adtQYcxUaQZxT-e0YsDUuwAAAEE"]
[Sun Apr 12 18:35:14.049565 2026] [autoindex:error] [pid 25437:tid 25457] [client 20.251.10.65:23777] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 18:35:24.689264 2026] [autoindex:error] [pid 60280:tid 60299] [client 20.251.10.65:45295] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 18:35:33.923174 2026] [:error] [pid 25327:tid 25353] [client 20.251.10.65:15910] [client 20.251.10.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adt1dS6h2tZEVJo9JFLOWAAAABE"]
[Sun Apr 12 18:35:36.236426 2026] [autoindex:error] [pid 26600:tid 26649] [client 20.251.10.65:43457] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 06:55:22.870299 2026] [:error] [pid 33943:tid 34007] [client 143.244.57.88:34930] [client 143.244.57.88] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "adwi2qyoXuZjocnxM5GH8QAAAIE"]
[Mon Apr 13 06:55:23.749892 2026] [:error] [pid 11325:tid 11339] [client 143.244.57.88:34946] [client 143.244.57.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.57.88, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adwi2-CGj3EEJtCwa0O6RgAAAQw"]
[Mon Apr 13 08:12:21.865399 2026] [:error] [pid 63311:tid 63395] [client 189.63.235.218:12654] [client 189.63.235.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.63.235.218, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adw05aHjrGN1MqBCVFkkaQAAAJg"]
[Mon Apr 13 10:24:42.025738 2026] [autoindex:error] [pid 7228:tid 7242] [client 143.110.250.39:58282] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Apr 13 13:13:03.066074 2026] [:error] [pid 63311:tid 63376] [client 142.111.152.111:30377] [client 142.111.152.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.111.152.111, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "adx7X6HjrGN1MqBCVFmNGAAAAIU"]
[Mon Apr 13 13:43:01.538044 2026] [:error] [pid 7228:tid 7247] [client 112.202.108.207:28990] [client 112.202.108.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.202.108.207, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "adyCZQEnn1dQrOSHHNXhlgAAARE"]
[Mon Apr 13 20:40:16.229751 2026] [:error] [pid 63406:tid 63431] [client 103.77.107.178:61305] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "adzkMLHZEIkQ0Zmgp5qqVwAAANQ"]
[Tue Apr 14 01:01:31.326607 2026] [:error] [pid 59913:tid 59922] [client 176.3.56.156:15198] [client 176.3.56.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.3.56.156, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ad0ha65XvQ9C-gZtr2yc_AAAAAU"]
[Tue Apr 14 01:10:21.581147 2026] [:error] [pid 59914:tid 59952] [client 212.47.78.118:65366] [client 212.47.78.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "ad0jfeq0YMmB3OWbbUk_BwAAAEg"]
[Tue Apr 14 01:10:22.158605 2026] [:error] [pid 60317:tid 60364] [client 212.47.78.118:63025] [client 212.47.78.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "ad0jfrBo7Bc8I7P_P-97tAAAANg"]
[Tue Apr 14 01:10:22.711358 2026] [:error] [pid 60317:tid 60350] [client 212.47.78.118:63468] [client 212.47.78.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/media/system/js/core.js"] [unique_id "ad0jfrBo7Bc8I7P_P-97tgAAAMo"]
[Tue Apr 14 03:17:48.649301 2026] [:error] [pid 16502:tid 16557] [client 209.87.169.133:23103] [client 209.87.169.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.133, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ad1BXEEJn1AN84QnLGn7VwAAAEg"]
[Tue Apr 14 08:29:35.800900 2026] [:error] [pid 37048:tid 37057] [client 216.73.216.108:58049] [client 216.73.216.108] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||www.perthactive.com.au|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "www.perthactive.com.au"] [uri "/robots.txt"] [unique_id "ad2Kb552Bo1OyzeXo_yR-QAAAQc"]
[Tue Apr 14 09:00:53.967655 2026] [:error] [pid 37226:tid 37237] [client 158.158.43.6:33618] [client 158.158.43.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "ad2RxZOA5-IQ0IVmQCrPNQAAAUk"]
[Tue Apr 14 09:01:20.359626 2026] [:error] [pid 35630:tid 35704] [client 158.158.43.6:29986] [client 158.158.43.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tiny.php"] [unique_id "ad2R4Der0pVFxOiOauXH4AAAAJI"]
[Tue Apr 14 09:03:45.490805 2026] [:error] [pid 35713:tid 35735] [client 158.158.43.6:35810] [client 158.158.43.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/wincust.php"] [unique_id "ad2Sca6-hhx6ZepqOSnZCAAAANM"]
[Tue Apr 14 14:05:29.146697 2026] [:error] [pid 35630:tid 35687] [client 44.242.203.86:55908] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "ad3ZKTer0pVFxOiOauUPZwAAAIE"]
[Tue Apr 14 14:05:30.640470 2026] [:error] [pid 18776:tid 18781] [client 44.242.203.86:55946] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "ad3ZKsIjIcAYZxezzAWobwAAAcM"]
[Tue Apr 14 14:05:31.366001 2026] [:error] [pid 35630:tid 35698] [client 44.242.203.86:55962] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local"] [unique_id "ad3ZKzer0pVFxOiOauUPewAAAIw"]
[Tue Apr 14 14:05:32.103512 2026] [:error] [pid 35630:tid 35700] [client 44.242.203.86:55984] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production"] [unique_id "ad3ZLDer0pVFxOiOauUPgAAAAI4"]
[Tue Apr 14 14:05:32.917055 2026] [:error] [pid 35628:tid 35650] [client 44.242.203.86:55996] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.staging"] [unique_id "ad3ZLOfPm-ozGuwCWXLgfgAAABI"]
[Tue Apr 14 14:05:36.743727 2026] [:error] [pid 4902:tid 4913] [client 44.242.203.86:49332] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.test"] [unique_id "ad3ZMIv8vJvl9lGy39hjBAAAAYk"]
[Tue Apr 14 14:05:37.468483 2026] [:error] [pid 37226:tid 37251] [client 44.242.203.86:49350] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.remote"] [unique_id "ad3ZMZOA5-IQ0IVmQCos5AAAAVc"]
[Tue Apr 14 14:05:38.197932 2026] [:error] [pid 18776:tid 18792] [client 44.242.203.86:49376] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.bak"] [unique_id "ad3ZMsIjIcAYZxezzAWoeAAAAc4"]
[Tue Apr 14 14:05:38.924945 2026] [:error] [pid 35629:tid 35667] [client 44.242.203.86:49388] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.backup"] [unique_id "ad3ZMjY8VahzC1YJBSj6XQAAAEg"]
[Tue Apr 14 14:05:39.654666 2026] [:error] [pid 35628:tid 35648] [client 44.242.203.86:49402] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.save"] [unique_id "ad3ZM-fPm-ozGuwCWXLggQAAABA"]
[Tue Apr 14 14:05:40.383454 2026] [:error] [pid 35713:tid 35728] [client 44.242.203.86:49416] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.old"] [unique_id "ad3ZNK6-hhx6ZepqOSlc5AAAAMw"]
[Tue Apr 14 14:05:41.109591 2026] [:error] [pid 35628:tid 35656] [client 44.242.203.86:49436] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.sample"] [unique_id "ad3ZNefPm-ozGuwCWXLgggAAABg"]
[Tue Apr 14 14:05:41.834993 2026] [:error] [pid 35628:tid 35651] [client 44.242.203.86:49456] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.example"] [unique_id "ad3ZNefPm-ozGuwCWXLghAAAABM"]
[Tue Apr 14 14:05:42.561008 2026] [:error] [pid 37226:tid 37230] [client 44.242.203.86:49468] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.dev"] [unique_id "ad3ZNpOA5-IQ0IVmQCos5wAAAUI"]
[Tue Apr 14 14:05:43.289595 2026] [:error] [pid 37048:tid 37064] [client 44.242.203.86:49488] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.prod"] [unique_id "ad3ZN552Bo1OyzeXo_zhzwAAAQ4"]
[Tue Apr 14 14:05:44.017203 2026] [:error] [pid 35628:tid 35639] [client 44.242.203.86:49508] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.stage"] [unique_id "ad3ZOOfPm-ozGuwCWXLgiQAAAAc"]
[Tue Apr 14 14:05:44.743580 2026] [:error] [pid 35630:tid 35704] [client 44.242.203.86:49528] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.ci"] [unique_id "ad3ZODer0pVFxOiOauUPkQAAAJI"]
[Tue Apr 14 14:05:45.469453 2026] [:error] [pid 35713:tid 35737] [client 44.242.203.86:49554] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.docker"] [unique_id "ad3ZOa6-hhx6ZepqOSlc5QAAANU"]
[Tue Apr 14 14:05:46.196531 2026] [:error] [pid 35629:tid 35660] [client 44.242.203.86:49574] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.live"] [unique_id "ad3ZOjY8VahzC1YJBSj6ZQAAAEE"]
[Tue Apr 14 14:05:46.930518 2026] [:error] [pid 35630:tid 35710] [client 44.242.203.86:42876] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.preprod"] [unique_id "ad3ZOjer0pVFxOiOauUPkwAAAJg"]
[Tue Apr 14 14:05:47.659624 2026] [:error] [pid 37048:tid 37050] [client 44.242.203.86:42894] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.uat"] [unique_id "ad3ZO552Bo1OyzeXo_zh0AAAAQA"]
[Tue Apr 14 14:05:48.391773 2026] [:error] [pid 35629:tid 35675] [client 44.242.203.86:42910] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.dist"] [unique_id "ad3ZPDY8VahzC1YJBSj6aQAAAFA"]
[Tue Apr 14 14:05:49.117639 2026] [:error] [pid 35629:tid 35681] [client 44.242.203.86:42922] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.swp"] [unique_id "ad3ZPTY8VahzC1YJBSj6bQAAAFY"]
[Tue Apr 14 14:05:49.842928 2026] [:error] [pid 35629:tid 35670] [client 44.242.203.86:42936] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env~"] [unique_id "ad3ZPTY8VahzC1YJBSj6bwAAAEs"]
[Tue Apr 14 14:05:50.568927 2026] [:error] [pid 35629:tid 35660] [client 44.242.203.86:42956] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/app/.env"] [unique_id "ad3ZPjY8VahzC1YJBSj6cwAAAEE"]
[Tue Apr 14 14:05:51.302569 2026] [:error] [pid 18776:tid 18784] [client 44.242.203.86:42964] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/apps/.env"] [unique_id "ad3ZP8IjIcAYZxezzAWogAAAAcY"]
[Tue Apr 14 14:05:52.029421 2026] [:error] [pid 35630:tid 35686] [client 44.242.203.86:42970] [client 44.242.203.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.env"] [unique_id "ad3ZQDer0pVFxOiOauUPnAAAAIA"]
[Tue Apr 14 19:43:31.790538 2026] [:error] [pid 59986:tid 60028] [client 79.173.251.112:50221] [client 79.173.251.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.173.251.112, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ad4oY56axKeW6bX4H7dD7QAAAEg"]
[Tue Apr 14 22:09:25.183191 2026] [:error] [pid 22177:tid 22196] [client 216.81.248.211:44242] [client 216.81.248.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "ad5KlYTVeJSXHDIlEDuS0QAAARE"]
[Wed Apr 15 00:56:18.837744 2026] [:error] [pid 17926:tid 17947] [client 20.251.219.158:32541] [client 20.251.219.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "ad5xsvKxFvgDwMI04zBOzgAAAc4"]
[Wed Apr 15 00:56:42.034026 2026] [:error] [pid 62295:tid 62300] [client 20.251.219.158:47337] [client 20.251.219.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tiny.php"] [unique_id "ad5xyhng-JDNFCa0Bnhg6QAAAAE"]
[Wed Apr 15 00:58:27.350766 2026] [:error] [pid 62297:tid 62369] [client 20.251.219.158:21046] [client 20.251.219.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/wincust.php"] [unique_id "ad5yM6vogcWlrafOEaG4agAAAQ8"]
[Wed Apr 15 13:34:13.423247 2026] [:error] [pid 11385:tid 11457] [client 13.92.159.84:50378] [client 13.92.159.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.92.159.84, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ad8jVR_mZoXMMCiUoKUSrgAAAMg"], referer: https://www.google.com
[Thu Apr 16 01:16:35.529096 2026] [:error] [pid 37370:tid 37372] [client 46.135.98.6:17530] [client 46.135.98.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.135.98.6, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ad_H83g-gnM2Ga0cGADLkQAAAQA"]
[Thu Apr 16 02:26:01.449543 2026] [:error] [pid 34542:tid 34556] [client 172.70.240.117:10918] [client 172.70.240.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.perthactive.com.au"] [uri "/"] [unique_id "ad_YOQdF4OGi-asleB6a3QAAAUw"]
[Thu Apr 16 02:43:15.993619 2026] [:error] [pid 791:tid 847] [client 91.200.101.138:59222] [client 91.200.101.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/graphql"] [unique_id "ad_cQ7xl5Y18om2fepnhXwAAAEc"]
[Thu Apr 16 03:20:01.832298 2026] [:error] [pid 34542:tid 34568] [client 37.140.223.250:31063] [client 37.140.223.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.250, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ad_k4QdF4OGi-asleB6onAAAAVg"]
[Thu Apr 16 10:08:09.654902 2026] [:error] [pid 57537:tid 57591] [client 216.45.61.243:57996] [client 216.45.61.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.perthactive.com.au"] [uri "/"] [unique_id "aeBEiVVQRS8nm73ENAlfbwAAAFA"], referer: https://www.google.com
[Thu Apr 16 12:43:59.330763 2026] [:error] [pid 57536:tid 57552] [client 98.93.160.221:42684] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "aeBpDyQU4faGja6jpDvHsQAAAAQ"]
[Thu Apr 16 21:29:10.514791 2026] [:error] [pid 57536:tid 57568] [client 45.130.203.145:59575] [client 45.130.203.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/HEAD"] [unique_id "aeDkJiQU4faGja6jpDuFhgAAABQ"]
[Thu Apr 16 21:29:11.300115 2026] [:error] [pid 57639:tid 57665] [client 45.130.203.169:27797] [client 45.130.203.169] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/HEAD"] [unique_id "aeDkJ6MCQoTw7TsxWum4GwAAANM"]
[Thu Apr 16 23:04:39.863507 2026] [autoindex:error] [pid 57639:tid 57668] [client 20.199.113.127:45885] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 16 23:05:14.639096 2026] [autoindex:error] [pid 7880:tid 7890] [client 20.199.113.127:18552] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 16 23:05:22.842688 2026] [autoindex:error] [pid 57639:tid 57659] [client 20.199.113.127:46013] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 16 23:05:30.143521 2026] [:error] [pid 29603:tid 29625] [client 20.199.113.127:18479] [client 20.199.113.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeD6ulfGOR6fpTWUAzq2kQAAARQ"]
[Thu Apr 16 23:05:31.835118 2026] [autoindex:error] [pid 57639:tid 57647] [client 20.199.113.127:18559] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 00:24:09.606713 2026] [:error] [pid 43386:tid 43435] [client 8.229.162.221:61611] [client 8.229.162.221] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeENKe91GAVgUfhPVDGsygAAAE8"]
[Fri Apr 17 00:24:11.988853 2026] [:error] [pid 3245:tid 3265] [client 8.229.162.221:60415] [client 8.229.162.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.229.162.221, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aeENK6ESOMTHVLs-uFC0BAAAAQM"]
[Fri Apr 17 03:14:22.898412 2026] [:error] [pid 11854:tid 11873] [client 34.86.178.51:60546] [client 34.86.178.51] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeE1DtxJCSIaqP1XSdapsgAAAlA"]
[Fri Apr 17 03:14:24.610011 2026] [:error] [pid 43387:tid 43459] [client 34.86.178.51:53901] [client 34.86.178.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.178.51, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aeE1ECBNsONqHxWTakVmogAAAIg"]
[Fri Apr 17 04:02:27.845426 2026] [:error] [pid 9153:tid 9224] [client 209.38.89.62:59780] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/install.php"] [unique_id "aeFAU-MHGxkTZX3c45etxgAAAIY"]
[Fri Apr 17 04:02:27.940295 2026] [:error] [pid 9153:tid 9239] [client 209.38.89.62:59796] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp/wp-admin/install.php"] [unique_id "aeFAU-MHGxkTZX3c45etyAAAAJU"]
[Fri Apr 17 04:02:27.998849 2026] [:error] [pid 9153:tid 9227] [client 209.38.89.62:59812] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/new/wp-admin/install.php"] [unique_id "aeFAU-MHGxkTZX3c45etyQAAAIk"]
[Fri Apr 17 04:02:28.100486 2026] [:error] [pid 9153:tid 9233] [client 209.38.89.62:59818] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/old/wp-admin/install.php"] [unique_id "aeFAVOMHGxkTZX3c45etygAAAI8"]
[Fri Apr 17 04:02:28.290357 2026] [:error] [pid 9153:tid 9222] [client 209.38.89.62:59820] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wordpress/wp-admin/install.php"] [unique_id "aeFAVOMHGxkTZX3c45etzAAAAIQ"]
[Fri Apr 17 04:02:28.400816 2026] [:error] [pid 9151:tid 9163] [client 209.38.89.62:59834] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/test/wp-admin/install.php"] [unique_id "aeFAVMhTVuRPkua22vRiDAAAAAI"]
[Fri Apr 17 04:02:28.655887 2026] [:error] [pid 9263:tid 9278] [client 209.38.89.62:59840] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/blog/wp-admin/install.php"] [unique_id "aeFAVBP68VyHNvj1e56NEAAAAM0"]
[Fri Apr 17 04:02:28.704629 2026] [:error] [pid 9263:tid 9284] [client 209.38.89.62:59850] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/cms/wp-admin/install.php"] [unique_id "aeFAVBP68VyHNvj1e56NEgAAANM"]
[Fri Apr 17 04:02:28.754026 2026] [:error] [pid 9263:tid 9269] [client 209.38.89.62:59854] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/web/wp-admin/install.php"] [unique_id "aeFAVBP68VyHNvj1e56NEwAAAMQ"]
[Fri Apr 17 04:02:28.791590 2026] [:error] [pid 9263:tid 9272] [client 209.38.89.62:59860] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/backup/wp-admin/install.php"] [unique_id "aeFAVBP68VyHNvj1e56NFAAAAMc"]
[Fri Apr 17 04:02:28.844430 2026] [:error] [pid 9263:tid 9275] [client 209.38.89.62:59862] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/site/wp-admin/install.php"] [unique_id "aeFAVBP68VyHNvj1e56NFgAAAMo"]
[Fri Apr 17 04:02:29.122069 2026] [:error] [pid 9151:tid 9161] [client 209.38.89.62:59876] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/oldsite/wp-admin/install.php"] [unique_id "aeFAVchTVuRPkua22vRiDwAAAAA"]
[Fri Apr 17 04:02:29.467051 2026] [:error] [pid 9263:tid 9281] [client 209.38.89.62:59884] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/shop/wp-admin/install.php"] [unique_id "aeFAVRP68VyHNvj1e56NGgAAANA"]
[Fri Apr 17 06:42:56.536110 2026] [autoindex:error] [pid 9153:tid 9233] [client 75.119.128.178:64973] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Apr 17 08:06:23.609430 2026] [:error] [pid 9153:tid 9218] [client 4.225.163.126:22333] [client 4.225.163.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.perthactive.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeF5f-MHGxkTZX3c45dp5gAAAIA"]
[Fri Apr 17 08:06:51.791761 2026] [:error] [pid 9152:tid 9198] [client 4.225.163.126:27603] [client 4.225.163.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.perthactive.com.au"] [uri "/tiny.php"] [unique_id "aeF5m5JYca8I3TNCwIdVygAAAEg"]
[Fri Apr 17 08:10:11.098909 2026] [:error] [pid 34273:tid 34293] [client 4.225.163.126:61675] [client 4.225.163.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.perthactive.com.au"] [uri "/wp-includes/wincust.php"] [unique_id "aeF6Y2uQDW686mK3dgExjwAAAZI"]
[Fri Apr 17 11:08:24.089755 2026] [autoindex:error] [pid 9152:tid 9196] [client 212.47.77.100:59545] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Apr 17 15:41:15.028342 2026] [autoindex:error] [pid 61523:tid 61550] [client 51.103.162.82:4073] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 15:42:10.850450 2026] [autoindex:error] [pid 51878:tid 51891] [client 51.103.162.82:34052] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 15:42:23.038013 2026] [autoindex:error] [pid 61523:tid 61565] [client 51.103.162.82:29095] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 15:42:34.572149 2026] [:error] [pid 51878:tid 51903] [client 51.103.162.82:29093] [client 51.103.162.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeHkaknQhUtMbw9EsgYrLAAAARc"]
[Fri Apr 17 15:42:37.216895 2026] [autoindex:error] [pid 9153:tid 9235] [client 51.103.162.82:29112] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 18 03:17:19.291048 2026] [:error] [pid 7297:tid 7303] [client 172.213.216.54:39386] [client 172.213.216.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeKHP_skyTNS2mWBKwxgVQAAAMQ"]
[Sat Apr 18 03:17:19.978628 2026] [:error] [pid 7297:tid 7300] [client 172.213.216.54:33397] [client 172.213.216.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeKHP_skyTNS2mWBKwxgWAAAAME"]
[Sat Apr 18 03:17:20.740500 2026] [:error] [pid 7183:tid 7252] [client 172.213.216.54:28451] [client 172.213.216.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeKHQOA91zZXz3qCkYfjFwAAAIw"]
[Sat Apr 18 03:17:21.743273 2026] [:error] [pid 7183:tid 7263] [client 172.213.216.54:49578] [client 172.213.216.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeKHQeA91zZXz3qCkYfjHAAAAJc"]
[Sat Apr 18 05:49:49.104206 2026] [:error] [pid 9970:tid 9991] [client 17.246.19.165:59718] [client 17.246.19.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 17.246.19.165, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aeKq_SYdRLRhVmaIMx3EewAAANE"]
[Sat Apr 18 06:21:44.370804 2026] [autoindex:error] [pid 13023:tid 13044] [client 4.223.163.152:19442] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 18 06:21:52.663827 2026] [autoindex:error] [pid 9865:tid 9940] [client 4.223.163.152:4043] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 18 06:22:00.164842 2026] [:error] [pid 9865:tid 9951] [client 4.223.163.152:19421] [client 4.223.163.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeKyiKzb5knECIY-C-i1YgAAAI4"]
[Sat Apr 18 06:22:01.908893 2026] [autoindex:error] [pid 9863:tid 9892] [client 4.223.163.152:19413] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 18 10:47:33.694089 2026] [:error] [pid 9970:tid 9987] [client 172.213.216.54:24281] [client 172.213.216.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "aeLwxSYdRLRhVmaIMx0zYwAAAM0"]
[Sat Apr 18 16:53:25.888410 2026] [:error] [pid 13023:tid 13031] [client 20.215.249.162:63139] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeNGhf1e7hG8DAeABB_QugAAAQY"]
[Sat Apr 18 16:53:28.245358 2026] [:error] [pid 9865:tid 9956] [client 20.215.249.162:64644] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeNGiKzb5knECIY-C-he3QAAAJM"]
[Sat Apr 18 16:53:30.237199 2026] [:error] [pid 34290:tid 34323] [client 20.215.249.162:64967] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeNGihqX6WpmmAXOBi_gwAAAAcQ"]
[Sat Apr 18 16:53:32.354986 2026] [:error] [pid 9864:tid 9927] [client 20.215.249.162:65382] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeNGjICFeowknfXHM7nTQQAAAFU"]
[Sat Apr 18 21:04:16.801872 2026] [:error] [pid 9970:tid 9996] [client 4.232.94.52:9157] [client 4.232.94.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tiny.php"] [unique_id "aeOBUCYdRLRhVmaIMx29_wAAANY"]
[Sat Apr 18 21:04:46.793655 2026] [:error] [pid 32677:tid 32697] [client 4.232.94.52:9207] [client 4.232.94.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeOBbhngmUE3LdC-wP7fGwAAAlE"]
[Sun Apr 19 03:17:01.245676 2026] [:error] [pid 41277:tid 41296] [client 172.98.33.29:20611] [client 172.98.33.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.33.29, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aePYrUH3ayszMLZYflsQaAAAAZE"]
[Sun Apr 19 05:39:32.661307 2026] [:error] [pid 47886:tid 47896] [client 54.215.139.236:58882] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aeP6FESe8yiyuPrD7yPscAAAAMg"]
[Sun Apr 19 05:39:34.015843 2026] [:error] [pid 15763:tid 15808] [client 54.215.139.236:58918] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aeP6FrMXv1Y1THOoxaAjogAAAgw"]
[Sun Apr 19 05:39:34.678030 2026] [:error] [pid 47775:tid 47843] [client 54.215.139.236:58932] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local"] [unique_id "aeP6Frmztjlk9tsmoexyOAAAAIA"]
[Sun Apr 19 05:39:35.334858 2026] [:error] [pid 15763:tid 15816] [client 54.215.139.236:58946] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production"] [unique_id "aeP6F7MXv1Y1THOoxaAjpAAAAhQ"]
[Sun Apr 19 05:39:35.988976 2026] [:error] [pid 47886:tid 47911] [client 54.215.139.236:58956] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.staging"] [unique_id "aeP6F0Se8yiyuPrD7yPsdgAAANc"]
[Sun Apr 19 05:39:36.650994 2026] [:error] [pid 15763:tid 15814] [client 54.215.139.236:51014] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.development"] [unique_id "aeP6GLMXv1Y1THOoxaAjpgAAAhI"]
[Sun Apr 19 05:39:37.311636 2026] [:error] [pid 47773:tid 47830] [client 54.215.139.236:51030] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.test"] [unique_id "aeP6GeiBHdnCJDuPq9BVGAAAAE4"]
[Sun Apr 19 05:39:37.974191 2026] [:error] [pid 47775:tid 47865] [client 54.215.139.236:51042] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.remote"] [unique_id "aeP6Gbmztjlk9tsmoexyPQAAAJY"]
[Sun Apr 19 05:39:38.631441 2026] [:error] [pid 47772:tid 47789] [client 54.215.139.236:51058] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.bak"] [unique_id "aeP6Goc0L16cb4smAz-fYwAAAAA"]
[Sun Apr 19 05:39:39.289566 2026] [:error] [pid 47772:tid 47795] [client 54.215.139.236:51076] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.backup"] [unique_id "aeP6G4c0L16cb4smAz-fZwAAAAY"]
[Sun Apr 19 05:39:39.954759 2026] [:error] [pid 15694:tid 15741] [client 54.215.139.236:51104] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.save"] [unique_id "aeP6G7imB-jol1fwqAq7dgAAAY8"]
[Sun Apr 19 05:39:40.618482 2026] [:error] [pid 15694:tid 15745] [client 54.215.139.236:51128] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.old"] [unique_id "aeP6HLimB-jol1fwqAq7egAAAZM"]
[Sun Apr 19 05:39:41.282607 2026] [:error] [pid 15694:tid 15724] [client 54.215.139.236:51146] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.sample"] [unique_id "aeP6HbimB-jol1fwqAq7ewAAAYE"]
[Sun Apr 19 05:39:41.944462 2026] [:error] [pid 15694:tid 15726] [client 54.215.139.236:51154] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.example"] [unique_id "aeP6HbimB-jol1fwqAq7fAAAAYM"]
[Sun Apr 19 05:39:42.610342 2026] [:error] [pid 15763:tid 15818] [client 54.215.139.236:51170] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.dev"] [unique_id "aeP6HrMXv1Y1THOoxaAjrgAAAhY"]
[Sun Apr 19 05:39:43.278897 2026] [:error] [pid 47772:tid 47793] [client 54.215.139.236:51184] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.prod"] [unique_id "aeP6H4c0L16cb4smAz-fegAAAAQ"]
[Sun Apr 19 05:39:43.936053 2026] [:error] [pid 47772:tid 47811] [client 54.215.139.236:51200] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.stage"] [unique_id "aeP6H4c0L16cb4smAz-ffgAAABY"]
[Sun Apr 19 05:39:44.597213 2026] [:error] [pid 47772:tid 47804] [client 54.215.139.236:51212] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.ci"] [unique_id "aeP6IIc0L16cb4smAz-fgAAAAA8"]
[Sun Apr 19 05:39:45.259136 2026] [:error] [pid 47772:tid 47792] [client 54.215.139.236:51226] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.docker"] [unique_id "aeP6IYc0L16cb4smAz-fhQAAAAM"]
[Sun Apr 19 05:39:45.922490 2026] [:error] [pid 15764:tid 15830] [client 54.215.139.236:51244] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.live"] [unique_id "aeP6IWLL_sqdSHoVp-TrlAAAAkQ"]
[Sun Apr 19 05:39:46.586308 2026] [:error] [pid 47773:tid 47832] [client 54.215.139.236:51270] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.preprod"] [unique_id "aeP6IuiBHdnCJDuPq9BVHQAAAFA"]
[Sun Apr 19 05:39:47.246054 2026] [:error] [pid 47772:tid 47799] [client 54.215.139.236:40268] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.uat"] [unique_id "aeP6I4c0L16cb4smAz-fiAAAAAo"]
[Sun Apr 19 05:39:47.903038 2026] [:error] [pid 15760:tid 15773] [client 54.215.139.236:40284] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.dist"] [unique_id "aeP6I_SdD_XHQMJ_ISsZEgAAAcU"]
[Sun Apr 19 05:39:48.561180 2026] [:error] [pid 47886:tid 47897] [client 54.215.139.236:40294] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.swp"] [unique_id "aeP6JESe8yiyuPrD7yPsgAAAAMk"]
[Sun Apr 19 05:39:49.227938 2026] [:error] [pid 15763:tid 15813] [client 54.215.139.236:40314] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env~"] [unique_id "aeP6JbMXv1Y1THOoxaAjsgAAAhE"]
[Sun Apr 19 05:39:49.892785 2026] [:error] [pid 47772:tid 47802] [client 54.215.139.236:40346] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/app/.env"] [unique_id "aeP6JYc0L16cb4smAz-fjAAAAA0"]
[Sun Apr 19 05:39:50.555514 2026] [:error] [pid 47775:tid 47848] [client 54.215.139.236:40376] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/apps/.env"] [unique_id "aeP6Jrmztjlk9tsmoexyQQAAAIU"]
[Sun Apr 19 05:39:51.228157 2026] [:error] [pid 47772:tid 47809] [client 54.215.139.236:40392] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.env"] [unique_id "aeP6J4c0L16cb4smAz-fkwAAABQ"]
[Sun Apr 19 05:39:51.887854 2026] [:error] [pid 47886:tid 47900] [client 54.215.139.236:40402] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/web/.env"] [unique_id "aeP6J0Se8yiyuPrD7yPsiAAAAMw"]
[Sun Apr 19 05:39:52.547321 2026] [:error] [pid 15764:tid 15834] [client 54.215.139.236:40416] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/site/.env"] [unique_id "aeP6KGLL_sqdSHoVp-TrngAAAkg"]
[Sun Apr 19 05:39:53.208087 2026] [:error] [pid 15760:tid 15768] [client 54.215.139.236:40438] [client 54.215.139.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/public/.env"] [unique_id "aeP6KfSdD_XHQMJ_ISsZFQAAAcA"]
[Sun Apr 19 22:04:15.777226 2026] [:error] [pid 47772:tid 47809] [client 138.68.5.226:49924] [client 138.68.5.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aeTg34c0L16cb4smAz_LCQAAABQ"]
[Sun Apr 19 22:50:49.894524 2026] [:error] [pid 15760:tid 15775] [client 146.70.194.222:45568] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aeTryfSdD_XHQMJ_IStfqgAAAcc"]
[Sun Apr 19 22:50:50.408293 2026] [:error] [pid 47886:tid 47905] [client 146.70.194.222:46344] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aeTrykSe8yiyuPrD7yOFggAAANE"]
[Sun Apr 19 22:50:50.948020 2026] [:error] [pid 15764:tid 15851] [client 146.70.194.222:47174] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aeTrymLL_sqdSHoVp-Q6awAAAlg"]
[Sun Apr 19 23:14:04.139841 2026] [:error] [pid 15763:tid 15798] [client 158.158.74.143:46020] [client 158.158.74.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "aeTxPLMXv1Y1THOoxaAYhwAAAgI"]
[Mon Apr 20 06:06:04.777334 2026] [:error] [pid 47731:tid 47753] [client 130.131.243.198:11595] [client 130.131.243.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 130.131.243.198, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aeVRzFOwpc-h7Nzn-iOdQgAAARQ"]
[Mon Apr 20 06:06:42.338945 2026] [:error] [pid 48101:tid 48120] [client 130.131.243.198:11344] [client 130.131.243.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.131.243.198, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aeVR8vIgenNbs2bVQGsWpgAAAZA"]
[Mon Apr 20 06:07:11.406470 2026] [autoindex:error] [pid 64334:tid 64414] [client 130.131.243.198:11338] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 06:07:11.598637 2026] [autoindex:error] [pid 64334:tid 64409] [client 130.131.243.198:11338] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 06:07:26.563770 2026] [autoindex:error] [pid 64333:tid 64396] [client 130.131.243.198:18228] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 06:07:26.749816 2026] [:error] [pid 64333:tid 64381] [client 130.131.243.198:18228] [client 130.131.243.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aeVSHnZav9wH8wxMd_tJXQAAAEU"]
[Mon Apr 20 06:07:30.791006 2026] [autoindex:error] [pid 48101:tid 48105] [client 130.131.243.198:11410] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 06:07:31.074962 2026] [autoindex:error] [pid 48101:tid 48120] [client 130.131.243.198:11410] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 06:07:33.461433 2026] [autoindex:error] [pid 64332:tid 64343] [client 130.131.243.198:19843] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 06:07:33.683105 2026] [autoindex:error] [pid 64332:tid 64349] [client 130.131.243.198:19843] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 13:35:58.604514 2026] [:error] [pid 11352:tid 11436] [client 103.65.237.216:62513] [client 103.65.237.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "aeW7Pml10mhMSfJ7ir90LgAAAJY"]
[Mon Apr 20 13:35:58.873955 2026] [:error] [pid 11350:tid 11375] [client 103.65.237.216:62659] [client 103.65.237.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.vscode/sftp.json"] [unique_id "aeW7Pv4EoMBgOJuJnT0uEwAAABA"]
[Mon Apr 20 13:53:14.328391 2026] [:error] [pid 42014:tid 42020] [client 131.100.39.69:50843] [client 131.100.39.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 131.100.39.69, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aeW_Ssek-00-ZI0f1Nr9hAAAAQQ"]
[Tue Apr 21 04:00:26.561024 2026] [:error] [pid 4823:tid 4861] [client 185.194.178.33:63551] [client 185.194.178.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.33, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aeaF2vc8mke3PfHqsxFaCAAAAYg"]
[Tue Apr 21 05:56:57.166146 2026] [:error] [pid 35320:tid 35339] [client 119.73.104.69:19617] [client 119.73.104.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.73.104.69, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aeahKYJW6fdXWO6agMGB4AAAAAk"]
[Tue Apr 21 09:50:19.368169 2026] [:error] [pid 4823:tid 4877] [client 157.245.253.171:58160] [client 157.245.253.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.245.253.171, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aebX2_c8mke3PfHqsxH9FwAAAZg"]
[Tue Apr 21 13:55:55.074986 2026] [:error] [pid 35321:tid 35401] [client 52.221.188.80:38144] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aecRazeHLhVUuu8cVXx-kwAAAFE"]
[Tue Apr 21 13:55:56.003841 2026] [:error] [pid 4777:tid 4805] [client 52.221.188.80:38170] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aecRbKxXur6bykKyLZRhDQAAARE"]
[Tue Apr 21 13:55:56.466773 2026] [:error] [pid 4777:tid 4808] [client 52.221.188.80:38180] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local"] [unique_id "aecRbKxXur6bykKyLZRhDgAAARQ"]
[Tue Apr 21 13:55:56.897520 2026] [:error] [pid 35320:tid 35332] [client 52.221.188.80:38204] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production"] [unique_id "aecRbIJW6fdXWO6agMHtMgAAAAI"]
[Tue Apr 21 13:55:57.331206 2026] [:error] [pid 35415:tid 35447] [client 52.221.188.80:34776] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.staging"] [unique_id "aecRbUiqDinI4_22zzg1ogAAANQ"]
[Tue Apr 21 13:55:57.787300 2026] [:error] [pid 4777:tid 4811] [client 52.221.188.80:34804] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.development"] [unique_id "aecRbaxXur6bykKyLZRhFAAAARc"]
[Tue Apr 21 13:55:58.248648 2026] [:error] [pid 5377:tid 5401] [client 52.221.188.80:34828] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.test"] [unique_id "aecRbrBKychFlrHBdvul4gAAAc8"]
[Tue Apr 21 13:55:58.688457 2026] [:error] [pid 4822:tid 4841] [client 52.221.188.80:34852] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.remote"] [unique_id "aecRbiAteFQFwS_23JlV7AAAAU8"]
[Tue Apr 21 13:55:59.164812 2026] [:error] [pid 35320:tid 35336] [client 52.221.188.80:34862] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.bak"] [unique_id "aecRb4JW6fdXWO6agMHtNAAAAAY"]
[Tue Apr 21 13:55:59.608781 2026] [:error] [pid 5377:tid 5400] [client 52.221.188.80:34888] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.backup"] [unique_id "aecRb7BKychFlrHBdvul6gAAAc4"]
[Tue Apr 21 13:56:00.078117 2026] [:error] [pid 35320:tid 35330] [client 52.221.188.80:34912] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.save"] [unique_id "aecRcIJW6fdXWO6agMHtNQAAAAA"]
[Tue Apr 21 13:56:00.523998 2026] [:error] [pid 35320:tid 35348] [client 52.221.188.80:34934] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.old"] [unique_id "aecRcIJW6fdXWO6agMHtOAAAABI"]
[Tue Apr 21 13:56:00.965810 2026] [:error] [pid 35415:tid 35429] [client 52.221.188.80:34964] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.sample"] [unique_id "aecRcEiqDinI4_22zzg1pgAAAMI"]
[Tue Apr 21 13:56:01.401546 2026] [:error] [pid 5377:tid 5394] [client 52.221.188.80:34970] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.example"] [unique_id "aecRcbBKychFlrHBdvul9gAAAcg"]
[Tue Apr 21 13:56:01.853206 2026] [:error] [pid 35320:tid 35350] [client 52.221.188.80:34988] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.dev"] [unique_id "aecRcYJW6fdXWO6agMHtOgAAABQ"]
[Tue Apr 21 13:56:02.283777 2026] [:error] [pid 35320:tid 35345] [client 52.221.188.80:34998] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.prod"] [unique_id "aecRcoJW6fdXWO6agMHtPAAAAA8"]
[Tue Apr 21 13:56:02.719079 2026] [:error] [pid 5377:tid 5399] [client 52.221.188.80:35014] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.stage"] [unique_id "aecRcrBKychFlrHBdvul_gAAAc0"]
[Tue Apr 21 13:56:03.151782 2026] [:error] [pid 35320:tid 35333] [client 52.221.188.80:35022] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.ci"] [unique_id "aecRc4JW6fdXWO6agMHtPgAAAAM"]
[Tue Apr 21 13:56:03.584125 2026] [:error] [pid 35322:tid 35361] [client 52.221.188.80:35032] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.docker"] [unique_id "aecRc6PoAfV40BTfVKylQwAAAIQ"]
[Tue Apr 21 13:56:04.017572 2026] [:error] [pid 4822:tid 4828] [client 52.221.188.80:35048] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.live"] [unique_id "aecRdCAteFQFwS_23JlV9AAAAUI"]
[Tue Apr 21 13:56:04.456799 2026] [:error] [pid 4822:tid 4839] [client 52.221.188.80:35068] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.preprod"] [unique_id "aecRdCAteFQFwS_23JlV-AAAAU0"]
[Tue Apr 21 13:56:04.896495 2026] [:error] [pid 4822:tid 4847] [client 52.221.188.80:35080] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.uat"] [unique_id "aecRdCAteFQFwS_23JlV-wAAAVU"]
[Tue Apr 21 13:56:05.328433 2026] [:error] [pid 4822:tid 4848] [client 52.221.188.80:35086] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.dist"] [unique_id "aecRdSAteFQFwS_23JlV_wAAAVY"]
[Tue Apr 21 13:56:05.760132 2026] [:error] [pid 4822:tid 4849] [client 52.221.188.80:35106] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.swp"] [unique_id "aecRdSAteFQFwS_23JlWAQAAAVc"]
[Tue Apr 21 13:56:06.193053 2026] [:error] [pid 4822:tid 4826] [client 52.221.188.80:35136] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env~"] [unique_id "aecRdiAteFQFwS_23JlWAwAAAUA"]
[Tue Apr 21 13:56:06.624798 2026] [:error] [pid 4822:tid 4843] [client 52.221.188.80:35156] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/app/.env"] [unique_id "aecRdiAteFQFwS_23JlWBQAAAVE"]
[Tue Apr 21 13:56:07.057630 2026] [:error] [pid 4822:tid 4847] [client 52.221.188.80:35178] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/apps/.env"] [unique_id "aecRdyAteFQFwS_23JlWCQAAAVU"]
[Tue Apr 21 13:56:07.497871 2026] [:error] [pid 4822:tid 4850] [client 52.221.188.80:42270] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.env"] [unique_id "aecRdyAteFQFwS_23JlWDAAAAVg"]
[Tue Apr 21 13:56:07.932722 2026] [:error] [pid 4822:tid 4845] [client 52.221.188.80:42288] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/web/.env"] [unique_id "aecRdyAteFQFwS_23JlWDgAAAVM"]
[Tue Apr 21 13:56:08.366604 2026] [:error] [pid 4822:tid 4839] [client 52.221.188.80:42308] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/site/.env"] [unique_id "aecReCAteFQFwS_23JlWEgAAAU0"]
[Tue Apr 21 13:56:08.801181 2026] [:error] [pid 35322:tid 35370] [client 52.221.188.80:42334] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/public/.env"] [unique_id "aecReKPoAfV40BTfVKylRAAAAI0"]
[Tue Apr 21 13:56:09.239062 2026] [:error] [pid 4777:tid 4794] [client 52.221.188.80:42340] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/admin/.env"] [unique_id "aecReaxXur6bykKyLZRhGgAAAQY"]
[Tue Apr 21 13:56:09.675149 2026] [:error] [pid 35415:tid 35428] [client 52.221.188.80:42362] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/backend/.env"] [unique_id "aecReUiqDinI4_22zzg1qwAAAME"]
[Tue Apr 21 13:56:10.105809 2026] [:error] [pid 35320:tid 35344] [client 52.221.188.80:42394] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/server/.env"] [unique_id "aecReoJW6fdXWO6agMHtQwAAAA4"]
[Tue Apr 21 13:56:10.535359 2026] [:error] [pid 35320:tid 35340] [client 52.221.188.80:42406] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/frontend/.env"] [unique_id "aecReoJW6fdXWO6agMHtRAAAAAo"]
[Tue Apr 21 13:56:10.971765 2026] [:error] [pid 4822:tid 4841] [client 52.221.188.80:42436] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/src/.env"] [unique_id "aecReiAteFQFwS_23JlWFAAAAU8"]
[Tue Apr 21 13:56:11.403761 2026] [:error] [pid 35320:tid 35338] [client 52.221.188.80:42454] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/core/.env"] [unique_id "aecRe4JW6fdXWO6agMHtRwAAAAg"]
[Tue Apr 21 13:56:11.836636 2026] [:error] [pid 5377:tid 5390] [client 52.221.188.80:42474] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/core/app/.env"] [unique_id "aecRe7BKychFlrHBdvumJwAAAcQ"]
[Tue Apr 21 13:56:12.269657 2026] [:error] [pid 4777:tid 4812] [client 52.221.188.80:42484] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/core/Database/.env"] [unique_id "aecRfKxXur6bykKyLZRhGwAAARg"]
[Tue Apr 21 13:56:12.701544 2026] [:error] [pid 4777:tid 4804] [client 52.221.188.80:42502] [client 52.221.188.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/config/.env"] [unique_id "aecRfKxXur6bykKyLZRhHAAAARA"]
[Tue Apr 21 14:17:18.588642 2026] [:error] [pid 4777:tid 4795] [client 47.128.65.101:53300] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "aecWbqxXur6bykKyLZRm2AAAAQc"]
[Tue Apr 21 14:17:19.503254 2026] [:error] [pid 4823:tid 4858] [client 47.128.65.101:53336] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env"] [unique_id "aecWb_c8mke3PfHqsxFw7wAAAYU"]
[Tue Apr 21 14:17:19.965491 2026] [:error] [pid 4823:tid 4864] [client 47.128.65.101:53354] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.local"] [unique_id "aecWb_c8mke3PfHqsxFw8wAAAYs"]
[Tue Apr 21 14:17:20.399029 2026] [:error] [pid 5377:tid 5389] [client 47.128.65.101:48618] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.production"] [unique_id "aecWcLBKychFlrHBdvutPgAAAcM"]
[Tue Apr 21 14:17:20.833262 2026] [:error] [pid 4822:tid 4842] [client 47.128.65.101:48642] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.staging"] [unique_id "aecWcCAteFQFwS_23JlmhAAAAVA"]
[Tue Apr 21 14:17:21.267178 2026] [:error] [pid 5377:tid 5393] [client 47.128.65.101:48646] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.development"] [unique_id "aecWcbBKychFlrHBdvutRQAAAcc"]
[Tue Apr 21 14:17:21.700580 2026] [:error] [pid 4822:tid 4836] [client 47.128.65.101:48656] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.test"] [unique_id "aecWcSAteFQFwS_23JlmjAAAAUo"]
[Tue Apr 21 14:17:22.136015 2026] [:error] [pid 4777:tid 4789] [client 47.128.65.101:48668] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.remote"] [unique_id "aecWcqxXur6bykKyLZRm7AAAAQE"]
[Tue Apr 21 14:17:22.569933 2026] [:error] [pid 5377:tid 5398] [client 47.128.65.101:48696] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.bak"] [unique_id "aecWcrBKychFlrHBdvutTAAAAcw"]
[Tue Apr 21 14:17:23.005487 2026] [:error] [pid 4822:tid 4842] [client 47.128.65.101:48714] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.backup"] [unique_id "aecWcyAteFQFwS_23JlmkQAAAVA"]
[Tue Apr 21 14:17:23.442697 2026] [:error] [pid 4822:tid 4831] [client 47.128.65.101:48734] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.save"] [unique_id "aecWcyAteFQFwS_23JlmlAAAAUU"]
[Tue Apr 21 14:17:23.876077 2026] [:error] [pid 5377:tid 5402] [client 47.128.65.101:48742] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.old"] [unique_id "aecWc7BKychFlrHBdvutVwAAAdA"]
[Tue Apr 21 14:17:24.308628 2026] [:error] [pid 35321:tid 35397] [client 47.128.65.101:48754] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.sample"] [unique_id "aecWdDeHLhVUuu8cVXyDQQAAAE0"]
[Tue Apr 21 14:17:24.742776 2026] [:error] [pid 35320:tid 35354] [client 47.128.65.101:48772] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.example"] [unique_id "aecWdIJW6fdXWO6agMHzMgAAABg"]
[Tue Apr 21 14:17:25.178195 2026] [:error] [pid 4822:tid 4847] [client 47.128.65.101:48796] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.dev"] [unique_id "aecWdSAteFQFwS_23JlmmwAAAVU"]
[Tue Apr 21 14:17:25.611559 2026] [:error] [pid 4822:tid 4835] [client 47.128.65.101:48808] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.prod"] [unique_id "aecWdSAteFQFwS_23JlmnwAAAUk"]
[Tue Apr 21 14:17:26.044444 2026] [:error] [pid 4823:tid 4867] [client 47.128.65.101:48826] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.stage"] [unique_id "aecWdvc8mke3PfHqsxFw-QAAAY4"]
[Tue Apr 21 14:17:26.477048 2026] [:error] [pid 4822:tid 4849] [client 47.128.65.101:48840] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.ci"] [unique_id "aecWdiAteFQFwS_23JlmpwAAAVc"]
[Tue Apr 21 14:17:26.908948 2026] [:error] [pid 4823:tid 4869] [client 47.128.65.101:48858] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.docker"] [unique_id "aecWdvc8mke3PfHqsxFw_gAAAZA"]
[Tue Apr 21 14:17:27.344526 2026] [:error] [pid 4823:tid 4876] [client 47.128.65.101:48872] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.live"] [unique_id "aecWd_c8mke3PfHqsxFxAAAAAZc"]
[Tue Apr 21 14:17:27.777815 2026] [:error] [pid 35320:tid 35347] [client 47.128.65.101:48900] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.preprod"] [unique_id "aecWd4JW6fdXWO6agMHzOwAAABE"]
[Tue Apr 21 14:17:28.210700 2026] [:error] [pid 4823:tid 4877] [client 47.128.65.101:48922] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.uat"] [unique_id "aecWePc8mke3PfHqsxFxBgAAAZg"]
[Tue Apr 21 14:17:28.644065 2026] [:error] [pid 35320:tid 35332] [client 47.128.65.101:48952] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.dist"] [unique_id "aecWeIJW6fdXWO6agMHzPQAAAAI"]
[Tue Apr 21 14:17:29.077642 2026] [:error] [pid 35322:tid 35377] [client 47.128.65.101:48970] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.swp"] [unique_id "aecWeaPoAfV40BTfVKypewAAAJQ"]
[Tue Apr 21 14:17:29.511141 2026] [:error] [pid 4822:tid 4838] [client 47.128.65.101:48980] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env~"] [unique_id "aecWeSAteFQFwS_23JlmtwAAAUw"]
[Tue Apr 21 14:17:29.942443 2026] [:error] [pid 4822:tid 4833] [client 47.128.65.101:48984] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/app/.env"] [unique_id "aecWeSAteFQFwS_23JlmvgAAAUc"]
[Tue Apr 21 14:17:30.374578 2026] [:error] [pid 4822:tid 4848] [client 47.128.65.101:44732] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/apps/.env"] [unique_id "aecWeiAteFQFwS_23JlmwgAAAVY"]
[Tue Apr 21 14:17:30.811894 2026] [:error] [pid 4823:tid 4859] [client 47.128.65.101:44742] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/api/.env"] [unique_id "aecWevc8mke3PfHqsxFxCwAAAYY"]
[Tue Apr 21 14:17:31.248318 2026] [:error] [pid 4823:tid 4860] [client 47.128.65.101:44766] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/web/.env"] [unique_id "aecWe_c8mke3PfHqsxFxDwAAAYc"]
[Tue Apr 21 14:17:31.681307 2026] [:error] [pid 4822:tid 4828] [client 47.128.65.101:44788] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/site/.env"] [unique_id "aecWeyAteFQFwS_23JlmzQAAAUI"]
[Tue Apr 21 14:17:32.114763 2026] [:error] [pid 35320:tid 35337] [client 47.128.65.101:44804] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/public/.env"] [unique_id "aecWfIJW6fdXWO6agMHzQgAAAAc"]
[Tue Apr 21 14:17:32.547841 2026] [:error] [pid 35415:tid 35434] [client 47.128.65.101:44816] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/admin/.env"] [unique_id "aecWfEiqDinI4_22zzg7gwAAAMc"]
[Tue Apr 21 14:17:32.980589 2026] [:error] [pid 35320:tid 35345] [client 47.128.65.101:44838] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/backend/.env"] [unique_id "aecWfIJW6fdXWO6agMHzSAAAAA8"]
[Tue Apr 21 14:17:33.413503 2026] [:error] [pid 4823:tid 4865] [client 47.128.65.101:44864] [client 47.128.65.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/server/.env"] [unique_id "aecWffc8mke3PfHqsxFxFgAAAYw"]
[Tue Apr 21 15:52:16.579426 2026] [:error] [pid 54080:tid 54094] [client 164.90.143.116:57802] [client 164.90.143.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 164.90.143.116, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aecssIzEbQHHxtmWbaZiQwAAAsw"]
[Tue Apr 21 16:31:47.788200 2026] [autoindex:error] [pid 35321:tid 35392] [client 158.158.52.146:46397] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 16:31:52.295967 2026] [autoindex:error] [pid 53832:tid 53855] [client 158.158.52.146:45728] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 16:32:09.253837 2026] [autoindex:error] [pid 35320:tid 35337] [client 158.158.52.146:45741] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 16:33:06.745118 2026] [autoindex:error] [pid 35320:tid 35349] [client 158.158.52.146:45792] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 16:33:16.063509 2026] [autoindex:error] [pid 54080:tid 54083] [client 158.158.52.146:45744] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 16:33:17.613491 2026] [autoindex:error] [pid 4823:tid 4864] [client 158.158.52.146:45783] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 16:33:24.485344 2026] [:error] [pid 35415:tid 35445] [client 158.158.52.146:46407] [client 158.158.52.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aec2VEiqDinI4_22zzhfHwAAANI"]
[Tue Apr 21 16:33:26.425808 2026] [autoindex:error] [pid 35320:tid 35345] [client 158.158.52.146:46362] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 16:33:44.008664 2026] [autoindex:error] [pid 54080:tid 54094] [client 158.158.52.146:45823] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 19:12:47.771860 2026] [:error] [pid 35321:tid 35408] [client 158.158.112.217:34956] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws78.php"] [unique_id "aedbrzeHLhVUuu8cVXxJqwAAAFg"]
[Tue Apr 21 19:12:50.325413 2026] [:error] [pid 35321:tid 35406] [client 158.158.112.217:54594] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws78.php"] [unique_id "aedbsjeHLhVUuu8cVXxJtQAAAFY"]
[Tue Apr 21 19:12:58.089221 2026] [:error] [pid 54080:tid 54095] [client 34.57.41.58:53176] [client 34.57.41.58] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "aedbuozEbQHHxtmWbaaecQAAAs0"]
[Tue Apr 21 19:12:59.020249 2026] [:error] [pid 35320:tid 35334] [client 158.158.112.217:49803] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/motu.php"] [unique_id "aedbu4JW6fdXWO6agMGMdwAAAAQ"]
[Tue Apr 21 19:12:59.088310 2026] [:error] [pid 35415:tid 35447] [client 34.57.41.58:51492] [client 34.57.41.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.57.41.58, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aedbu0iqDinI4_22zzhqZQAAANQ"]
[Tue Apr 21 19:13:03.186659 2026] [:error] [pid 35320:tid 35350] [client 158.158.112.217:6885] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/motu.php"] [unique_id "aedbv4JW6fdXWO6agMGMngAAABQ"]
[Tue Apr 21 19:13:09.679956 2026] [:error] [pid 4823:tid 4863] [client 158.158.112.217:44602] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/motu.php"] [unique_id "aedbxfc8mke3PfHqsxHwMQAAAYo"]
[Tue Apr 21 19:13:17.907655 2026] [:error] [pid 35320:tid 35337] [client 158.158.112.217:31929] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/hplfuns.php"] [unique_id "aedbzYJW6fdXWO6agMGMzgAAAAc"]
[Tue Apr 21 19:13:24.262924 2026] [:error] [pid 53832:tid 53838] [client 158.158.112.217:34465] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/hplfuns.php"] [unique_id "aedb1NzkuxsE_OhM9UJaaQAAAkM"]
[Tue Apr 21 19:13:29.096131 2026] [:error] [pid 53832:tid 53838] [client 158.158.112.217:61693] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/hplfuns.php"] [unique_id "aedb2dzkuxsE_OhM9UJacgAAAkM"]
[Tue Apr 21 19:13:31.235838 2026] [:error] [pid 35415:tid 35441] [client 158.158.112.217:25919] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xa.php"] [unique_id "aedb20iqDinI4_22zzhqjwAAAM4"]
[Tue Apr 21 19:13:39.807690 2026] [:error] [pid 35320:tid 35330] [client 158.158.112.217:54558] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xa.php"] [unique_id "aedb44JW6fdXWO6agMGNCwAAAAA"]
[Tue Apr 21 19:13:41.232465 2026] [:error] [pid 53832:tid 53853] [client 158.158.112.217:54591] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xa.php"] [unique_id "aedb5dzkuxsE_OhM9UJajQAAAlI"]
[Tue Apr 21 19:13:43.372011 2026] [:error] [pid 53978:tid 53990] [client 158.158.112.217:30986] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xa.php"] [unique_id "aedb551ivsR4hcOSQbYB9QAAAoo"]
[Tue Apr 21 19:13:57.899126 2026] [:error] [pid 53978:tid 53991] [client 158.158.112.217:31012] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sadcut1.php"] [unique_id "aedb9Z1ivsR4hcOSQbYCCgAAAos"]
[Tue Apr 21 19:13:59.964177 2026] [:error] [pid 53978:tid 54003] [client 158.158.112.217:26175] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sadcut1.php"] [unique_id "aedb951ivsR4hcOSQbYCDQAAApc"]
[Tue Apr 21 19:14:02.156811 2026] [:error] [pid 35321:tid 35408] [client 158.158.112.217:30981] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sadcut1.php"] [unique_id "aedb-jeHLhVUuu8cVXxKZgAAAFg"]
[Tue Apr 21 19:14:04.865576 2026] [:error] [pid 53731:tid 53756] [client 158.158.112.217:64388] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/666.php"] [unique_id "aedb_F2I9THUR-bRVGw73AAAAhQ"]
[Tue Apr 21 19:14:06.259780 2026] [:error] [pid 35321:tid 35395] [client 158.158.112.217:26159] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/666.php"] [unique_id "aedb_jeHLhVUuu8cVXxKeQAAAEs"]
[Tue Apr 21 19:14:07.937357 2026] [:error] [pid 53978:tid 53985] [client 158.158.112.217:24360] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/666.php"] [unique_id "aedb_51ivsR4hcOSQbYCFAAAAoU"]
[Tue Apr 21 19:14:09.561125 2026] [:error] [pid 35321:tid 35393] [client 158.158.112.217:39395] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/666.php"] [unique_id "aedcATeHLhVUuu8cVXxKigAAAEk"]
[Tue Apr 21 19:14:11.184263 2026] [:error] [pid 35321:tid 35399] [client 158.158.112.217:62282] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xwx1.php"] [unique_id "aedcAzeHLhVUuu8cVXxKlgAAAE8"]
[Tue Apr 21 19:14:17.598255 2026] [:error] [pid 35321:tid 35387] [client 158.158.112.217:28865] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xwx1.php"] [unique_id "aedcCTeHLhVUuu8cVXxKuQAAAEM"]
[Tue Apr 21 19:14:19.354632 2026] [:error] [pid 35320:tid 35333] [client 158.158.112.217:45162] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xwx1.php"] [unique_id "aedcC4JW6fdXWO6agMGNggAAAAM"]
[Tue Apr 21 19:14:21.672670 2026] [:error] [pid 53731:tid 53759] [client 158.158.112.217:25578] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xwx1.php"] [unique_id "aedcDV2I9THUR-bRVGw77wAAAhc"]
[Tue Apr 21 19:14:24.873665 2026] [:error] [pid 54080:tid 54088] [client 158.158.112.217:30962] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/prosellers8.php"] [unique_id "aedcEIzEbQHHxtmWbaaevQAAAsY"]
[Tue Apr 21 19:14:27.174053 2026] [:error] [pid 35321:tid 35397] [client 158.158.112.217:28902] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/prosellers8.php"] [unique_id "aedcEzeHLhVUuu8cVXxK1QAAAE0"]
[Tue Apr 21 19:14:28.194387 2026] [:error] [pid 35415:tid 35438] [client 158.158.112.217:6990] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/prosellers8.php"] [unique_id "aedcFEiqDinI4_22zzhqmwAAAMs"]
[Tue Apr 21 19:14:30.009794 2026] [:error] [pid 53832:tid 53852] [client 158.158.112.217:30953] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/prosellers8.php"] [unique_id "aedcFtzkuxsE_OhM9UJaqgAAAlE"]
[Tue Apr 21 19:14:30.830635 2026] [:error] [pid 35321:tid 35396] [client 158.158.112.217:26658] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/shop.php"] [unique_id "aedcFjeHLhVUuu8cVXxK3gAAAEw"]
[Tue Apr 21 19:14:32.300758 2026] [:error] [pid 35322:tid 35379] [client 158.158.112.217:30930] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/shop.php"] [unique_id "aedcGKPoAfV40BTfVKzVZwAAAJY"]
[Tue Apr 21 19:14:34.851015 2026] [:error] [pid 35320:tid 35352] [client 158.158.112.217:32121] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/shop.php"] [unique_id "aedcGoJW6fdXWO6agMGNsAAAABY"]
[Tue Apr 21 19:14:36.862817 2026] [:error] [pid 35415:tid 35430] [client 158.158.112.217:7002] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/shop.php"] [unique_id "aedcHEiqDinI4_22zzhqngAAAMM"]
[Tue Apr 21 19:14:37.616060 2026] [:error] [pid 35321:tid 35404] [client 158.158.112.217:61568] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww.php"] [unique_id "aedcHTeHLhVUuu8cVXxK6wAAAFQ"]
[Tue Apr 21 19:14:39.185537 2026] [:error] [pid 35321:tid 35386] [client 158.158.112.217:36912] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww.php"] [unique_id "aedcHzeHLhVUuu8cVXxK7QAAAEI"]
[Tue Apr 21 19:14:41.019316 2026] [:error] [pid 4823:tid 4856] [client 158.158.112.217:55112] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww.php"] [unique_id "aedcIfc8mke3PfHqsxHwsgAAAYM"]
[Tue Apr 21 19:14:42.489278 2026] [:error] [pid 35321:tid 35390] [client 158.158.112.217:25808] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ww.php"] [unique_id "aedcIjeHLhVUuu8cVXxK_AAAAEY"]
[Tue Apr 21 19:14:43.938489 2026] [:error] [pid 35321:tid 35393] [client 158.158.112.217:49857] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fsjzs.php"] [unique_id "aedcIzeHLhVUuu8cVXxLBwAAAEk"]
[Tue Apr 21 19:14:46.039025 2026] [:error] [pid 35321:tid 35402] [client 158.158.112.217:6955] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fsjzs.php"] [unique_id "aedcJjeHLhVUuu8cVXxLDQAAAFI"]
[Tue Apr 21 19:14:48.675715 2026] [:error] [pid 35320:tid 35340] [client 158.158.112.217:25343] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/fsjzs.php"] [unique_id "aedcKIJW6fdXWO6agMGOEgAAAAo"]
[Tue Apr 21 19:14:56.195406 2026] [:error] [pid 35321:tid 35390] [client 158.158.112.217:33520] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/atomlib.php"] [unique_id "aedcMDeHLhVUuu8cVXxLTwAAAEY"]
[Tue Apr 21 19:14:57.907575 2026] [:error] [pid 35321:tid 35400] [client 158.158.112.217:29620] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/atomlib.php"] [unique_id "aedcMTeHLhVUuu8cVXxLXQAAAFA"]
[Tue Apr 21 19:15:01.156593 2026] [:error] [pid 35321:tid 35384] [client 158.158.112.217:6386] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/atomlib.php"] [unique_id "aedcNTeHLhVUuu8cVXxLgAAAAEA"]
[Tue Apr 21 19:15:04.947354 2026] [:error] [pid 35320:tid 35330] [client 158.158.112.217:7106] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/atomlib.php"] [unique_id "aedcOIJW6fdXWO6agMGOPAAAAAA"]
[Tue Apr 21 19:15:07.804061 2026] [:error] [pid 35415:tid 35445] [client 158.158.112.217:26099] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/zoper1.php"] [unique_id "aedcO0iqDinI4_22zzhqogAAANI"]
[Tue Apr 21 19:15:10.684947 2026] [:error] [pid 35321:tid 35394] [client 158.158.112.217:31837] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/zoper1.php"] [unique_id "aedcPjeHLhVUuu8cVXxLtQAAAEo"]
[Tue Apr 21 19:15:11.998476 2026] [:error] [pid 35321:tid 35397] [client 158.158.112.217:29587] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/zoper1.php"] [unique_id "aedcPzeHLhVUuu8cVXxLvAAAAE0"]
[Tue Apr 21 19:15:14.833979 2026] [:error] [pid 54080:tid 54106] [client 158.158.112.217:44500] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/zoper1.php"] [unique_id "aedcQozEbQHHxtmWbaafAgAAAtg"]
[Tue Apr 21 19:15:17.829978 2026] [:error] [pid 35321:tid 35400] [client 158.158.112.217:33423] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a5.php"] [unique_id "aedcRTeHLhVUuu8cVXxL7AAAAFA"]
[Tue Apr 21 19:15:20.911453 2026] [:error] [pid 35320:tid 35339] [client 158.158.112.217:24263] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a5.php"] [unique_id "aedcSIJW6fdXWO6agMGOTwAAAAk"]
[Tue Apr 21 19:15:23.437802 2026] [:error] [pid 35321:tid 35396] [client 158.158.112.217:44504] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a5.php"] [unique_id "aedcSzeHLhVUuu8cVXxMIgAAAEw"]
[Tue Apr 21 19:15:24.553147 2026] [:error] [pid 53978:tid 53985] [client 158.158.112.217:37063] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a5.php"] [unique_id "aedcTJ1ivsR4hcOSQbYCdQAAAoU"]
[Tue Apr 21 19:15:25.818770 2026] [:error] [pid 35320:tid 35333] [client 158.158.112.217:37064] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ai.php"] [unique_id "aedcTYJW6fdXWO6agMGOXQAAAAM"]
[Tue Apr 21 19:15:27.496345 2026] [:error] [pid 35321:tid 35399] [client 158.158.112.217:32350] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ai.php"] [unique_id "aedcTzeHLhVUuu8cVXxMNAAAAE8"]
[Tue Apr 21 19:15:28.543108 2026] [:error] [pid 35321:tid 35392] [client 158.158.112.217:36826] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ai.php"] [unique_id "aedcUDeHLhVUuu8cVXxMOgAAAEg"]
[Tue Apr 21 19:15:30.525518 2026] [:error] [pid 54080:tid 54083] [client 158.158.112.217:44526] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ai.php"] [unique_id "aedcUozEbQHHxtmWbaafKwAAAsE"]
[Tue Apr 21 19:15:35.027042 2026] [:error] [pid 35320:tid 35337] [client 158.158.112.217:37111] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/jga.php"] [unique_id "aedcV4JW6fdXWO6agMGOdwAAAAc"]
[Tue Apr 21 19:15:35.821888 2026] [:error] [pid 35320:tid 35351] [client 158.158.112.217:26366] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/jga.php"] [unique_id "aedcV4JW6fdXWO6agMGOewAAABU"]
[Tue Apr 21 19:15:38.319893 2026] [:error] [pid 53731:tid 53741] [client 158.158.112.217:24273] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/jga.php"] [unique_id "aedcWl2I9THUR-bRVGw8rQAAAgY"]
[Tue Apr 21 19:15:40.126935 2026] [:error] [pid 35320:tid 35345] [client 158.158.112.217:37115] [client 158.158.112.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/jga.php"] [unique_id "aedcXIJW6fdXWO6agMGOnwAAAA8"]
[Tue Apr 21 19:36:51.075411 2026] [:error] [pid 53978:tid 54000] [client 159.89.230.36:53039] [client 159.89.230.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.89.230.36, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aedhU51ivsR4hcOSQbYIzgAAApQ"]
[Tue Apr 21 23:52:37.535451 2026] [:error] [pid 4823:tid 4854] [client 149.102.230.117:39360] [client 149.102.230.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aeedRfc8mke3PfHqsxEXygAAAYE"]
[Tue Apr 21 23:52:38.409757 2026] [:error] [pid 53832:tid 53855] [client 149.102.230.118:36006] [client 149.102.230.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aeedRtzkuxsE_OhM9UKLwQAAAlQ"]
[Tue Apr 21 23:52:38.929640 2026] [:error] [pid 35321:tid 35384] [client 149.102.230.117:39372] [client 149.102.230.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aeedRjeHLhVUuu8cVXwgbQAAAEA"]
[Tue Apr 21 23:52:39.797336 2026] [:error] [pid 4823:tid 4866] [client 149.102.230.119:17610] [client 149.102.230.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aeedR_c8mke3PfHqsxEX0QAAAY0"]
[Tue Apr 21 23:52:40.328164 2026] [:error] [pid 35321:tid 35395] [client 149.102.230.118:36020] [client 149.102.230.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aeedSDeHLhVUuu8cVXwgcQAAAEs"]
[Tue Apr 21 23:52:40.851243 2026] [:error] [pid 35320:tid 35335] [client 149.102.230.118:36028] [client 149.102.230.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aeedSIJW6fdXWO6agMEzsgAAAAU"]
[Tue Apr 21 23:52:41.376462 2026] [:error] [pid 35320:tid 35340] [client 149.102.230.118:36044] [client 149.102.230.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aeedSYJW6fdXWO6agMEztQAAAAo"]
[Wed Apr 22 12:13:55.479484 2026] [:error] [pid 32095:tid 32110] [client 92.205.20.61:42922] [client 92.205.20.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.20.61, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aehLA9fu5Cv628YPe5-ZHgAAA4w"]
[Wed Apr 22 12:13:55.492009 2026] [:error] [pid 21683:tid 21762] [client 92.205.20.61:43496] [client 92.205.20.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.20.61, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aehLA1ZBWT-0diZyYybOKwAAAIw"]
[Wed Apr 22 12:14:26.174659 2026] [:error] [pid 32053:tid 32073] [client 80.97.49.108:46556] [client 80.97.49.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 80.97.49.108, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aehLIgzPjXx_ocfbYhtqVQAAA1I"]
[Wed Apr 22 16:41:41.172184 2026] [:error] [pid 6384:tid 6409] [client 106.213.80.129:18445] [client 106.213.80.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.213.80.129, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aeiJxT58M3t15ICeWHW-7gAAANY"]
[Wed Apr 22 16:41:42.370319 2026] [:error] [pid 9085:tid 9096] [client 106.213.80.129:26833] [client 106.213.80.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.213.80.129, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aeiJxt-_-or9vQnlWnrKUwAAAUk"]
[Wed Apr 22 22:53:15.894301 2026] [:error] [pid 9085:tid 9096] [client 45.150.174.91:56596] [client 45.150.174.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.150.174.91, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aejg29-_-or9vQnlWnrMNAAAAUk"]
[Thu Apr 23 00:58:34.200650 2026] [autoindex:error] [pid 9085:tid 9104] [client 207.180.209.135:55176] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Apr 23 08:28:01.708034 2026] [:error] [pid 64998:tid 65020] [client 41.84.244.151:65165] [client 41.84.244.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.84.244.151, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aelnkYV5EysYcTLjmwg44gAAAdI"]
[Thu Apr 23 09:55:21.872932 2026] [:error] [pid 43083:tid 43102] [client 91.230.225.196:24813] [client 91.230.225.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/amax.php"] [unique_id "ael8CTC5hrvNXosL83IWgQAAANE"]
[Thu Apr 23 09:55:34.874524 2026] [:error] [pid 25635:tid 25655] [client 185.192.71.30:56165] [client 185.192.71.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "ael8FsRxv6UsgRGKB3L6bAAAARA"]
[Thu Apr 23 09:55:37.849597 2026] [:error] [pid 64967:tid 64969] [client 91.230.225.14:62847] [client 91.230.225.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "ael8GYAV4GfOOdX8QzoxZAAAAYA"]
[Thu Apr 23 09:55:45.303299 2026] [:error] [pid 42972:tid 43038] [client 91.230.225.19:36811] [client 91.230.225.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tinyfilemanager.php"] [unique_id "ael8IcOAb-3sOknsk4dE3AAAAFY"]
[Thu Apr 23 09:55:49.180327 2026] [:error] [pid 64998:tid 65003] [client 91.230.225.206:37545] [client 91.230.225.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "ael8JYV5EysYcTLjmwh7mgAAAcE"]
[Thu Apr 23 09:55:55.285032 2026] [:error] [pid 64967:tid 64979] [client 91.230.225.18:49551] [client 91.230.225.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "ael8K4AV4GfOOdX8Qzox9QAAAYo"]
[Thu Apr 23 09:55:56.445483 2026] [:error] [pid 25635:tid 25642] [client 91.230.225.206:56073] [client 91.230.225.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "ael8LMRxv6UsgRGKB3L7cQAAAQM"]
[Thu Apr 23 09:55:57.007791 2026] [:error] [pid 42973:tid 43056] [client 185.192.71.26:45183] [client 185.192.71.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "ael8LW6I0QqmmmLTHE3y0gAAAI0"]
[Thu Apr 23 09:55:57.585303 2026] [:error] [pid 59700:tid 59714] [client 91.230.225.19:37131] [client 91.230.225.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "ael8LZXyGZJFeAIDWtmVOgAAAUw"]
[Thu Apr 23 09:55:58.128985 2026] [:error] [pid 42972:tid 43032] [client 91.230.225.17:46515] [client 91.230.225.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "ael8LsOAb-3sOknsk4dFSgAAAFA"]
[Thu Apr 23 09:55:58.662727 2026] [:error] [pid 43083:tid 43089] [client 91.230.225.208:58843] [client 91.230.225.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "ael8LjC5hrvNXosL83IYQgAAAMQ"]
[Thu Apr 23 09:56:01.158999 2026] [:error] [pid 42971:tid 42995] [client 91.230.225.12:49215] [client 91.230.225.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "ael8MTEP2_5RswrH8bHcKgAAAAk"]
[Thu Apr 23 09:56:02.766549 2026] [:error] [pid 42971:tid 42996] [client 91.230.225.203:63903] [client 91.230.225.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "ael8MjEP2_5RswrH8bHcSgAAAAo"]
[Thu Apr 23 09:56:06.063686 2026] [:error] [pid 43083:tid 43108] [client 91.230.225.10:58549] [client 91.230.225.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "ael8NjC5hrvNXosL83IYeQAAANc"]
[Thu Apr 23 09:56:07.357418 2026] [:error] [pid 64967:tid 64979] [client 91.230.225.208:62727] [client 91.230.225.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "ael8N4AV4GfOOdX8QzoyuwAAAYo"]
[Thu Apr 23 09:56:09.814167 2026] [:error] [pid 43083:tid 43089] [client 91.230.225.196:43301] [client 91.230.225.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "ael8OTC5hrvNXosL83IYzQAAAMQ"]
[Thu Apr 23 09:56:16.188051 2026] [:error] [pid 25635:tid 25642] [client 185.192.71.30:61805] [client 185.192.71.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "ael8QMRxv6UsgRGKB3L8MgAAAQM"]
[Thu Apr 23 09:56:17.418803 2026] [:error] [pid 64967:tid 64989] [client 185.192.71.29:37919] [client 185.192.71.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "ael8QYAV4GfOOdX8QzozOQAAAZQ"]
[Thu Apr 23 09:56:19.502830 2026] [:error] [pid 42972:tid 43029] [client 91.230.225.196:58673] [client 91.230.225.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "ael8Q8OAb-3sOknsk4dGfAAAAE0"]
[Thu Apr 23 09:56:20.775796 2026] [:error] [pid 64998:tid 65018] [client 91.230.225.11:22975] [client 91.230.225.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "ael8RIV5EysYcTLjmwh-DQAAAdA"]
[Thu Apr 23 09:56:24.726483 2026] [:error] [pid 42973:tid 43047] [client 185.192.71.37:44007] [client 185.192.71.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "ael8SG6I0QqmmmLTHE3z6AAAAIQ"]
[Thu Apr 23 09:56:26.030895 2026] [:error] [pid 43083:tid 43099] [client 185.192.71.36:61677] [client 185.192.71.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "ael8SjC5hrvNXosL83IZZwAAAM4"]
[Thu Apr 23 09:56:27.348814 2026] [:error] [pid 64998:tid 65007] [client 185.192.71.34:41877] [client 185.192.71.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "ael8S4V5EysYcTLjmwh-7wAAAcU"]
[Thu Apr 23 09:56:27.886032 2026] [:error] [pid 59700:tid 59714] [client 91.230.225.11:55231] [client 91.230.225.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "ael8S5XyGZJFeAIDWtmWcAAAAUw"]
[Thu Apr 23 09:56:29.490332 2026] [:error] [pid 42973:tid 43064] [client 91.230.225.24:56989] [client 91.230.225.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "ael8TW6I0QqmmmLTHE30JwAAAJU"]
[Thu Apr 23 09:56:33.510636 2026] [:error] [pid 25635:tid 25660] [client 91.230.225.196:61353] [client 91.230.225.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "ael8UcRxv6UsgRGKB3L9RgAAARU"]
[Thu Apr 23 09:56:34.060560 2026] [:error] [pid 42971:tid 43002] [client 91.230.225.17:27705] [client 91.230.225.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "ael8UjEP2_5RswrH8bHdkQAAABA"]
[Thu Apr 23 09:56:34.603672 2026] [:error] [pid 65000:tid 65029] [client 185.192.71.23:20071] [client 185.192.71.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "ael8Ur6vRb9j6psK2ZYChgAAAgA"]
[Thu Apr 23 09:56:49.789628 2026] [autoindex:error] [pid 42972:tid 43030] [client 91.230.225.12:65417] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:56:52.793494 2026] [autoindex:error] [pid 64998:tid 65011] [client 185.192.71.24:62449] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:00.668689 2026] [autoindex:error] [pid 65000:tid 65056] [client 91.230.225.205:65069] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:01.897966 2026] [autoindex:error] [pid 59700:tid 59705] [client 91.230.225.201:41643] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:09.842903 2026] [autoindex:error] [pid 64998:tid 65006] [client 91.230.225.18:52839] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:10.122767 2026] [autoindex:error] [pid 64998:tid 65023] [client 91.230.225.18:52839] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:10.412735 2026] [autoindex:error] [pid 64998:tid 65019] [client 91.230.225.18:52839] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:10.686317 2026] [autoindex:error] [pid 64998:tid 65026] [client 91.230.225.18:52839] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/languages/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:11.262651 2026] [autoindex:error] [pid 64998:tid 65004] [client 91.230.225.18:52839] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:11.539555 2026] [autoindex:error] [pid 64998:tid 65010] [client 91.230.225.18:52839] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:11.814672 2026] [autoindex:error] [pid 64998:tid 65006] [client 91.230.225.18:52839] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:13.057787 2026] [autoindex:error] [pid 25635:tid 25649] [client 91.230.225.10:37875] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:13.350826 2026] [autoindex:error] [pid 25635:tid 25647] [client 91.230.225.10:37875] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:13.649790 2026] [autoindex:error] [pid 25635:tid 25648] [client 91.230.225.10:37875] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:14.263947 2026] [autoindex:error] [pid 25635:tid 25654] [client 91.230.225.10:37875] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:14.557248 2026] [autoindex:error] [pid 25635:tid 25661] [client 91.230.225.10:37875] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:14.856580 2026] [autoindex:error] [pid 25635:tid 25642] [client 91.230.225.10:37875] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:17.391941 2026] [autoindex:error] [pid 59700:tid 59702] [client 185.192.71.30:60709] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:17.684347 2026] [autoindex:error] [pid 59700:tid 59703] [client 185.192.71.30:60709] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:17.986096 2026] [autoindex:error] [pid 59700:tid 59712] [client 185.192.71.30:60709] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:18.281169 2026] [autoindex:error] [pid 59700:tid 59720] [client 185.192.71.30:60709] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:18.571958 2026] [autoindex:error] [pid 59700:tid 59710] [client 185.192.71.30:60709] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:18.857925 2026] [autoindex:error] [pid 59700:tid 59716] [client 185.192.71.30:60709] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:21.167134 2026] [autoindex:error] [pid 25635:tid 25640] [client 91.230.225.21:34663] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:21.442732 2026] [autoindex:error] [pid 25635:tid 25653] [client 91.230.225.21:34663] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:25.280434 2026] [autoindex:error] [pid 25635:tid 25646] [client 185.192.71.26:24829] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:28.081249 2026] [autoindex:error] [pid 64998:tid 65022] [client 91.230.225.199:26125] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:28.361909 2026] [autoindex:error] [pid 64998:tid 65021] [client 91.230.225.199:26125] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:28.645778 2026] [autoindex:error] [pid 64998:tid 65008] [client 91.230.225.199:26125] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:31.339357 2026] [autoindex:error] [pid 43083:tid 43089] [client 185.192.71.25:44647] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:31.622141 2026] [autoindex:error] [pid 43083:tid 43109] [client 185.192.71.25:44647] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:34.376912 2026] [autoindex:error] [pid 65000:tid 65049] [client 185.192.71.36:63729] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:35.362148 2026] [autoindex:error] [pid 42971:tid 42992] [client 185.192.71.40:48903] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:36.340160 2026] [autoindex:error] [pid 64998:tid 65007] [client 185.192.71.27:49621] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:36.633253 2026] [autoindex:error] [pid 64998:tid 65016] [client 185.192.71.27:49621] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:36.966205 2026] [autoindex:error] [pid 64998:tid 65004] [client 185.192.71.27:49621] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:37.261586 2026] [autoindex:error] [pid 64998:tid 65022] [client 185.192.71.27:49621] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:37.545903 2026] [autoindex:error] [pid 64998:tid 65024] [client 185.192.71.27:49621] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:39.573101 2026] [autoindex:error] [pid 59700:tid 59725] [client 185.192.71.36:63503] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:39.866397 2026] [autoindex:error] [pid 59700:tid 59718] [client 185.192.71.36:63503] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/random_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:40.767854 2026] [autoindex:error] [pid 64998:tid 65023] [client 91.230.225.13:36619] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:41.037553 2026] [autoindex:error] [pid 64998:tid 65007] [client 91.230.225.13:36619] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:43.405340 2026] [autoindex:error] [pid 25635:tid 25640] [client 185.192.71.28:20311] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:44.404999 2026] [autoindex:error] [pid 64998:tid 65024] [client 91.230.225.10:25881] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:46.408745 2026] [autoindex:error] [pid 64998:tid 65005] [client 185.192.71.33:48963] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:48.071025 2026] [autoindex:error] [pid 42971:tid 42998] [client 185.192.71.35:39279] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:49.293124 2026] [autoindex:error] [pid 42972:tid 43039] [client 185.192.71.40:21467] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:49.567369 2026] [autoindex:error] [pid 42972:tid 43031] [client 185.192.71.40:21467] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:49.843910 2026] [autoindex:error] [pid 42972:tid 43024] [client 185.192.71.40:21467] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:50.119525 2026] [autoindex:error] [pid 42972:tid 43027] [client 185.192.71.40:21467] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/themes/twentytwentytwo/assets/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:53.024147 2026] [proxy_fcgi:error] [pid 25635:tid 25643] [client 91.230.225.208:39663] AH01071: Got error 'PHP message: PHP Fatal error: Uncaught Error: Undefined constant "ABSPATH" in /home/perthactivecom/public_html/wp-includes/blocks/index.php:8\nStack trace:\n#0 {main}\n thrown in /home/perthactivecom/public_html/wp-includes/blocks/index.php on line 8'
[Thu Apr 23 09:57:55.390076 2026] [autoindex:error] [pid 42971:tid 42987] [client 91.230.225.195:23337] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:55.672125 2026] [autoindex:error] [pid 42971:tid 43003] [client 91.230.225.195:23337] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:55.964556 2026] [autoindex:error] [pid 42971:tid 43002] [client 91.230.225.195:23337] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:57:56.241711 2026] [autoindex:error] [pid 42971:tid 43001] [client 91.230.225.195:23337] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:03.456757 2026] [autoindex:error] [pid 64998:tid 65008] [client 185.192.71.39:43897] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:03.732751 2026] [autoindex:error] [pid 64998:tid 65009] [client 185.192.71.39:43897] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:04.074332 2026] [autoindex:error] [pid 64998:tid 65003] [client 185.192.71.39:43897] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:04.358549 2026] [autoindex:error] [pid 64998:tid 65002] [client 185.192.71.39:43897] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:04.626384 2026] [:error] [pid 64998:tid 65021] [client 185.192.71.39:43897] [client 185.192.71.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/src/"] [unique_id "ael8rIV5EysYcTLjmwiGlQAAAdM"]
[Thu Apr 23 09:58:05.192443 2026] [autoindex:error] [pid 64998:tid 65018] [client 91.230.225.205:50099] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:06.194432 2026] [autoindex:error] [pid 65000:tid 65057] [client 185.192.71.23:28645] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/Parse/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:07.423385 2026] [autoindex:error] [pid 42973:tid 43054] [client 185.192.71.28:27557] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/Cache/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:07.703390 2026] [autoindex:error] [pid 42973:tid 43047] [client 185.192.71.28:27557] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:07.989497 2026] [autoindex:error] [pid 42973:tid 43053] [client 185.192.71.28:27557] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/languages/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:12.401858 2026] [autoindex:error] [pid 42973:tid 43050] [client 91.230.225.202:44757] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:16.645191 2026] [autoindex:error] [pid 43083:tid 43091] [client 91.230.225.200:28267] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:16.922327 2026] [autoindex:error] [pid 43083:tid 43107] [client 91.230.225.200:28267] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:17.203256 2026] [autoindex:error] [pid 43083:tid 43106] [client 91.230.225.200:28267] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:17.489424 2026] [autoindex:error] [pid 43083:tid 43108] [client 91.230.225.200:28267] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:20.212192 2026] [:error] [pid 42971:tid 43003] [client 185.192.71.30:39701] [client 185.192.71.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wordpress/wp-includes/"] [unique_id "ael8vDEP2_5RswrH8bHhzgAAABE"]
[Thu Apr 23 09:58:21.573043 2026] [autoindex:error] [pid 42972:tid 43037] [client 91.230.225.20:51361] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:24.356865 2026] [autoindex:error] [pid 25635:tid 25643] [client 185.192.71.24:22667] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:24.639367 2026] [autoindex:error] [pid 25635:tid 25662] [client 185.192.71.24:22667] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:33.084949 2026] [autoindex:error] [pid 65000:tid 65031] [client 91.230.225.203:37967] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:36.177545 2026] [autoindex:error] [pid 25635:tid 25662] [client 185.192.71.30:55851] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:36.459020 2026] [autoindex:error] [pid 25635:tid 25654] [client 185.192.71.30:55851] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 09:58:36.726353 2026] [:error] [pid 25635:tid 25653] [client 185.192.71.30:55851] [client 185.192.71.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/2021/"] [unique_id "ael8zMRxv6UsgRGKB3IDhAAAAQ4"]
[Thu Apr 23 09:58:37.270562 2026] [autoindex:error] [pid 64998:tid 65016] [client 185.192.71.25:46877] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 18:44:13.889371 2026] [:error] [pid 64998:tid 65018] [client 72.146.28.231:57224] [client 72.146.28.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tiny.php"] [unique_id "aen3_YV5EysYcTLjmwgqiwAAAdA"]
[Thu Apr 23 18:45:39.602702 2026] [:error] [pid 42972:tid 43026] [client 72.146.28.231:58859] [client 72.146.28.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aen4U8OAb-3sOknsk4f-AQAAAEo"]
[Thu Apr 23 22:44:56.876486 2026] [:error] [pid 42971:tid 42986] [client 74.248.147.253:54465] [client 74.248.147.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeowaDEP2_5RswrH8bE0UAAAAAA"]
[Thu Apr 23 23:49:48.416586 2026] [autoindex:error] [pid 59700:tid 59720] [client 173.239.218.55:33359] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:49:49.667795 2026] [autoindex:error] [pid 64998:tid 65008] [client 173.239.218.51:44909] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 00:48:33.597843 2026] [:error] [pid 46953:tid 46978] [client 62.112.201.5:61116] [client 62.112.201.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.112.201.5, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aepNYUnlpdHh-P6wKbpsswAAAlU"]
[Fri Apr 24 02:51:02.177787 2026] [:error] [pid 42973:tid 43059] [client 4.212.93.21:43548] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-class-atom.php"] [unique_id "aepqFm6I0QqmmmLTHE2S3wAAAJA"]
[Fri Apr 24 02:51:05.686822 2026] [:error] [pid 42972:tid 43036] [client 4.212.93.21:41579] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-class-atom.php"] [unique_id "aepqGcOAb-3sOknsk4fYdwAAAFQ"]
[Fri Apr 24 02:51:07.223556 2026] [:error] [pid 42972:tid 43022] [client 4.212.93.21:20493] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-class-atom.php"] [unique_id "aepqG8OAb-3sOknsk4fYeQAAAEY"]
[Fri Apr 24 02:51:09.167843 2026] [:error] [pid 64998:tid 65003] [client 4.212.93.21:22755] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-class-atom.php"] [unique_id "aepqHYV5EysYcTLjmwhO_gAAAcE"]
[Fri Apr 24 02:51:10.713514 2026] [:error] [pid 25635:tid 25639] [client 4.212.93.21:43577] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ms-edit.php"] [unique_id "aepqHsRxv6UsgRGKB3JWoQAAAQA"]
[Fri Apr 24 02:51:12.977976 2026] [:error] [pid 65000:tid 65050] [client 4.212.93.21:45433] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ms-edit.php"] [unique_id "aepqIL6vRb9j6psK2ZahvQAAAhE"]
[Fri Apr 24 02:51:14.181625 2026] [:error] [pid 42971:tid 43009] [client 4.212.93.21:48607] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ms-edit.php"] [unique_id "aepqIjEP2_5RswrH8bFYSwAAABc"]
[Fri Apr 24 02:51:15.825435 2026] [:error] [pid 64998:tid 65005] [client 4.212.93.21:45414] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ms-edit.php"] [unique_id "aepqI4V5EysYcTLjmwhPBwAAAcM"]
[Fri Apr 24 02:51:17.194296 2026] [:error] [pid 42972:tid 43034] [client 4.212.93.21:21768] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/press.php"] [unique_id "aepqJcOAb-3sOknsk4fYfAAAAFI"]
[Fri Apr 24 02:51:18.621147 2026] [:error] [pid 46953:tid 46957] [client 4.212.93.21:59643] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/press.php"] [unique_id "aepqJknlpdHh-P6wKbqE1QAAAkE"]
[Fri Apr 24 02:51:19.875794 2026] [:error] [pid 42972:tid 43036] [client 4.212.93.21:21772] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/press.php"] [unique_id "aepqJ8OAb-3sOknsk4fYgwAAAFQ"]
[Fri Apr 24 02:51:22.362066 2026] [:error] [pid 43083:tid 43088] [client 4.212.93.21:44044] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/press.php"] [unique_id "aepqKjC5hrvNXosL83K2VgAAAMM"]
[Fri Apr 24 02:51:23.643615 2026] [:error] [pid 64998:tid 65006] [client 4.212.93.21:21782] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/900.php"] [unique_id "aepqK4V5EysYcTLjmwhPDwAAAcQ"]
[Fri Apr 24 02:51:25.346886 2026] [:error] [pid 46953:tid 46964] [client 4.212.93.21:36994] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/900.php"] [unique_id "aepqLUnlpdHh-P6wKbqE2gAAAkg"]
[Fri Apr 24 02:51:26.892737 2026] [:error] [pid 42971:tid 42988] [client 4.212.93.21:20511] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/900.php"] [unique_id "aepqLjEP2_5RswrH8bFYVQAAAAI"]
[Fri Apr 24 02:51:27.890735 2026] [:error] [pid 42973:tid 43058] [client 4.212.93.21:43583] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/900.php"] [unique_id "aepqL26I0QqmmmLTHE2TDwAAAI8"]
[Fri Apr 24 02:51:29.366757 2026] [:error] [pid 42972:tid 43026] [client 4.212.93.21:43534] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-links-opml.php"] [unique_id "aepqMcOAb-3sOknsk4fYmAAAAEo"]
[Fri Apr 24 02:51:31.449788 2026] [:error] [pid 64967:tid 64992] [client 4.212.93.21:21787] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-links-opml.php"] [unique_id "aepqM4AV4GfOOdX8Qzqg4QAAAZc"]
[Fri Apr 24 02:51:32.891873 2026] [:error] [pid 64998:tid 65012] [client 4.212.93.21:24799] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-links-opml.php"] [unique_id "aepqNIV5EysYcTLjmwhPHwAAAco"]
[Fri Apr 24 02:51:33.962170 2026] [:error] [pid 43083:tid 43088] [client 4.212.93.21:24800] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-links-opml.php"] [unique_id "aepqNTC5hrvNXosL83K2XgAAAMM"]
[Fri Apr 24 02:51:35.969620 2026] [:error] [pid 64967:tid 64985] [client 4.212.93.21:37000] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/jk.php"] [unique_id "aepqN4AV4GfOOdX8Qzqg4wAAAZA"]
[Fri Apr 24 02:51:37.959577 2026] [:error] [pid 46953:tid 46970] [client 4.212.93.21:28712] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/jk.php"] [unique_id "aepqOUnlpdHh-P6wKbqE4gAAAk4"]
[Fri Apr 24 02:51:39.899291 2026] [:error] [pid 65000:tid 65041] [client 4.212.93.21:44035] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/jk.php"] [unique_id "aepqO76vRb9j6psK2Zah5gAAAgg"]
[Fri Apr 24 02:51:40.928504 2026] [:error] [pid 43083:tid 43109] [client 4.212.93.21:22762] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/jk.php"] [unique_id "aepqPDC5hrvNXosL83K2YQAAANg"]
[Fri Apr 24 02:51:42.999039 2026] [:error] [pid 59700:tid 59711] [client 4.212.93.21:44061] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/dx.php"] [unique_id "aepqPpXyGZJFeAIDWtmDsQAAAUk"]
[Fri Apr 24 02:51:45.272822 2026] [:error] [pid 43083:tid 43087] [client 4.212.93.21:28721] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/dx.php"] [unique_id "aepqQTC5hrvNXosL83K2ZwAAAMI"]
[Fri Apr 24 02:51:47.196584 2026] [:error] [pid 64998:tid 65002] [client 4.212.93.21:22756] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/dx.php"] [unique_id "aepqQ4V5EysYcTLjmwhPMQAAAcA"]
[Fri Apr 24 02:51:48.729574 2026] [:error] [pid 42971:tid 42986] [client 4.212.93.21:57472] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/dx.php"] [unique_id "aepqRDEP2_5RswrH8bFYXwAAAAA"]
[Fri Apr 24 02:51:50.857397 2026] [:error] [pid 42972:tid 43029] [client 4.212.93.21:59595] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/aa.php"] [unique_id "aepqRsOAb-3sOknsk4fYpQAAAE0"]
[Fri Apr 24 02:51:53.467491 2026] [:error] [pid 65000:tid 65037] [client 4.212.93.21:46630] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/aa.php"] [unique_id "aepqSb6vRb9j6psK2ZaiJQAAAgQ"]
[Fri Apr 24 02:51:56.919057 2026] [:error] [pid 64998:tid 65017] [client 4.212.93.21:57493] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/aa.php"] [unique_id "aepqTIV5EysYcTLjmwhPQQAAAc8"]
[Fri Apr 24 02:52:13.226297 2026] [:error] [pid 65000:tid 65040] [client 4.212.93.21:26337] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws88.php"] [unique_id "aepqXb6vRb9j6psK2ZaibQAAAgc"]
[Fri Apr 24 02:52:14.708633 2026] [:error] [pid 65000:tid 65043] [client 4.212.93.21:17985] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws88.php"] [unique_id "aepqXr6vRb9j6psK2ZaidQAAAgo"]
[Fri Apr 24 02:52:15.472654 2026] [:error] [pid 65000:tid 65041] [client 4.212.93.21:56939] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws88.php"] [unique_id "aepqX76vRb9j6psK2ZaieAAAAgg"]
[Fri Apr 24 02:52:16.487097 2026] [:error] [pid 25635:tid 25652] [client 4.212.93.21:40774] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws88.php"] [unique_id "aepqYMRxv6UsgRGKB3JWuwAAAQ0"]
[Fri Apr 24 02:52:17.521170 2026] [:error] [pid 59700:tid 59708] [client 4.212.93.21:40771] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/adoms.php"] [unique_id "aepqYZXyGZJFeAIDWtmDxAAAAUY"]
[Fri Apr 24 02:52:18.125071 2026] [:error] [pid 64967:tid 64970] [client 4.212.93.21:47908] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/adoms.php"] [unique_id "aepqYoAV4GfOOdX8Qzqg9QAAAYE"]
[Fri Apr 24 02:52:18.755421 2026] [:error] [pid 65000:tid 65042] [client 4.212.93.21:40777] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/adoms.php"] [unique_id "aepqYr6vRb9j6psK2ZaifQAAAgk"]
[Fri Apr 24 02:52:19.477756 2026] [:error] [pid 65000:tid 65055] [client 4.212.93.21:44035] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/adoms.php"] [unique_id "aepqY76vRb9j6psK2ZaigAAAAhY"]
[Fri Apr 24 02:52:20.327313 2026] [:error] [pid 42972:tid 43034] [client 4.212.93.21:28779] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/plugin-editor.php"] [unique_id "aepqZMOAb-3sOknsk4fY1AAAAFI"]
[Fri Apr 24 02:52:21.718961 2026] [:error] [pid 65000:tid 65050] [client 4.212.93.21:46638] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/plugin-editor.php"] [unique_id "aepqZb6vRb9j6psK2ZaiigAAAhE"]
[Fri Apr 24 02:52:22.673824 2026] [:error] [pid 65000:tid 65037] [client 4.212.93.21:48558] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/plugin-editor.php"] [unique_id "aepqZr6vRb9j6psK2ZaijwAAAgQ"]
[Fri Apr 24 02:52:24.578277 2026] [:error] [pid 42972:tid 43018] [client 4.212.93.21:48542] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/plugin-editor.php"] [unique_id "aepqaMOAb-3sOknsk4fY2AAAAEI"]
[Fri Apr 24 02:52:26.290640 2026] [:error] [pid 42972:tid 43035] [client 4.212.93.21:56922] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/8573.php"] [unique_id "aepqasOAb-3sOknsk4fY3QAAAFM"]
[Fri Apr 24 02:52:29.013877 2026] [:error] [pid 46953:tid 46959] [client 4.212.93.21:57530] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/8573.php"] [unique_id "aepqbUnlpdHh-P6wKbqFAgAAAkM"]
[Fri Apr 24 02:52:34.145579 2026] [:error] [pid 64998:tid 65021] [client 4.212.93.21:40787] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/8573.php"] [unique_id "aepqcoV5EysYcTLjmwhPYwAAAdM"]
[Fri Apr 24 02:52:41.414030 2026] [:error] [pid 65000:tid 65049] [client 4.212.93.21:28742] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/8573.php"] [unique_id "aepqeb6vRb9j6psK2Zai1wAAAhA"]
[Fri Apr 24 02:52:43.840570 2026] [:error] [pid 64998:tid 65004] [client 4.212.93.21:48526] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/an.php"] [unique_id "aepqe4V5EysYcTLjmwhPjQAAAcI"]
[Fri Apr 24 02:52:47.585906 2026] [:error] [pid 43083:tid 43097] [client 4.212.93.21:4144] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/an.php"] [unique_id "aepqfzC5hrvNXosL83K2ggAAAMw"]
[Fri Apr 24 02:52:51.156397 2026] [:error] [pid 64998:tid 65011] [client 4.212.93.21:44155] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/an.php"] [unique_id "aepqg4V5EysYcTLjmwhPmgAAAck"]
[Fri Apr 24 02:52:54.080281 2026] [:error] [pid 64998:tid 65009] [client 4.212.93.21:57495] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/an.php"] [unique_id "aepqhoV5EysYcTLjmwhPoAAAAcc"]
[Fri Apr 24 02:52:58.387739 2026] [:error] [pid 64967:tid 64982] [client 4.212.93.21:44152] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/t.php"] [unique_id "aepqioAV4GfOOdX8Qzqg_QAAAY0"]
[Fri Apr 24 02:53:01.670535 2026] [:error] [pid 64998:tid 65013] [client 4.212.93.21:36953] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/t.php"] [unique_id "aepqjYV5EysYcTLjmwhPqAAAAcs"]
[Fri Apr 24 02:53:05.139063 2026] [:error] [pid 43083:tid 43107] [client 4.212.93.21:46699] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/t.php"] [unique_id "aepqkTC5hrvNXosL83K2iAAAANY"]
[Fri Apr 24 02:53:07.856740 2026] [:error] [pid 42971:tid 42988] [client 4.212.93.21:47998] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/t.php"] [unique_id "aepqkzEP2_5RswrH8bFYhgAAAAI"]
[Fri Apr 24 02:53:09.321728 2026] [:error] [pid 59700:tid 59720] [client 4.212.93.21:38210] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aepqlZXyGZJFeAIDWtmD1wAAAVI"]
[Fri Apr 24 02:53:20.579400 2026] [:error] [pid 64998:tid 65003] [client 4.212.93.21:29440] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gaza.php"] [unique_id "aepqoIV5EysYcTLjmwhPvwAAAcE"]
[Fri Apr 24 02:53:24.130673 2026] [:error] [pid 65000:tid 65039] [client 4.212.93.21:17953] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gaza.php"] [unique_id "aepqpL6vRb9j6psK2ZajbwAAAgY"]
[Fri Apr 24 02:53:27.661180 2026] [:error] [pid 64967:tid 64973] [client 4.212.93.21:4973] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gaza.php"] [unique_id "aepqp4AV4GfOOdX8QzqhCQAAAYQ"]
[Fri Apr 24 02:53:30.027058 2026] [:error] [pid 65000:tid 65030] [client 4.212.93.21:17456] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gaza.php"] [unique_id "aepqqr6vRb9j6psK2ZajdQAAAgE"]
[Fri Apr 24 02:53:34.813672 2026] [:error] [pid 59700:tid 59717] [client 4.212.93.21:16943] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/kj.php"] [unique_id "aepqrpXyGZJFeAIDWtmEJAAAAU8"]
[Fri Apr 24 02:53:37.465636 2026] [:error] [pid 64967:tid 64989] [client 4.212.93.21:4930] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/kj.php"] [unique_id "aepqsYAV4GfOOdX8QzqhDQAAAZQ"]
[Fri Apr 24 02:53:45.707790 2026] [:error] [pid 42971:tid 42995] [client 4.212.93.21:56272] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/kj.php"] [unique_id "aepquTEP2_5RswrH8bFYmQAAAAk"]
[Fri Apr 24 02:53:46.234672 2026] [:error] [pid 65000:tid 65055] [client 4.212.93.21:57017] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/aboute.php"] [unique_id "aepqur6vRb9j6psK2ZajgAAAAhY"]
[Fri Apr 24 02:53:47.266666 2026] [:error] [pid 43083:tid 43107] [client 4.212.93.21:4171] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/aboute.php"] [unique_id "aepquzC5hrvNXosL83K2sQAAANY"]
[Fri Apr 24 02:53:49.056888 2026] [:error] [pid 65000:tid 65057] [client 4.212.93.21:4980] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/aboute.php"] [unique_id "aepqvb6vRb9j6psK2ZajgwAAAhg"]
[Fri Apr 24 02:53:52.831295 2026] [:error] [pid 42972:tid 43030] [client 4.212.93.21:34378] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/aboute.php"] [unique_id "aepqwMOAb-3sOknsk4fZaAAAAE4"]
[Fri Apr 24 02:53:57.428030 2026] [:error] [pid 65000:tid 65038] [client 4.212.93.21:65195] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws82.php"] [unique_id "aepqxb6vRb9j6psK2ZajjwAAAgU"]
[Fri Apr 24 02:54:01.427152 2026] [:error] [pid 65000:tid 65046] [client 4.212.93.21:65171] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws82.php"] [unique_id "aepqyb6vRb9j6psK2ZajlwAAAg0"]
[Fri Apr 24 02:54:08.192835 2026] [:error] [pid 65000:tid 65030] [client 4.212.93.21:56328] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws82.php"] [unique_id "aepq0L6vRb9j6psK2ZajrgAAAgE"]
[Fri Apr 24 02:54:10.981166 2026] [:error] [pid 42973:tid 43046] [client 4.212.93.21:35119] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/edit.php"] [unique_id "aepq0m6I0QqmmmLTHE2TcQAAAIM"]
[Fri Apr 24 02:54:13.534366 2026] [:error] [pid 64998:tid 65018] [client 4.212.93.21:22708] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/edit.php"] [unique_id "aepq1YV5EysYcTLjmwhQMQAAAdA"]
[Fri Apr 24 02:54:16.156075 2026] [:error] [pid 25635:tid 25647] [client 4.212.93.21:31852] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/edit.php"] [unique_id "aepq2MRxv6UsgRGKB3JW9AAAAQg"]
[Fri Apr 24 02:54:17.887160 2026] [:error] [pid 59700:tid 59725] [client 4.212.93.21:44776] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/edit.php"] [unique_id "aepq2ZXyGZJFeAIDWtmEcQAAAVc"]
[Fri Apr 24 02:54:23.402690 2026] [:error] [pid 42972:tid 43031] [client 4.212.93.21:23790] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bgymj.php"] [unique_id "aepq38OAb-3sOknsk4fZkwAAAE8"]
[Fri Apr 24 02:54:25.352569 2026] [:error] [pid 64998:tid 65026] [client 4.212.93.21:21379] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bgymj.php"] [unique_id "aepq4YV5EysYcTLjmwhQSwAAAdg"]
[Fri Apr 24 02:54:26.499633 2026] [:error] [pid 59700:tid 59713] [client 4.212.93.21:21378] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bgymj.php"] [unique_id "aepq4pXyGZJFeAIDWtmEeAAAAUs"]
[Fri Apr 24 02:54:28.071887 2026] [:error] [pid 46953:tid 46957] [client 4.212.93.21:4466] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bgymj.php"] [unique_id "aepq5EnlpdHh-P6wKbqFPwAAAkE"]
[Fri Apr 24 02:54:29.915076 2026] [:error] [pid 46953:tid 46975] [client 4.212.93.21:30573] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-good.php"] [unique_id "aepq5UnlpdHh-P6wKbqFQQAAAlM"]
[Fri Apr 24 02:54:31.383811 2026] [:error] [pid 64998:tid 65005] [client 4.212.93.21:30568] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-good.php"] [unique_id "aepq54V5EysYcTLjmwhQXAAAAcM"]
[Fri Apr 24 02:54:32.945627 2026] [:error] [pid 43083:tid 43099] [client 4.212.93.21:22259] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-good.php"] [unique_id "aepq6DC5hrvNXosL83K2ywAAAM4"]
[Fri Apr 24 02:54:33.991929 2026] [:error] [pid 42973:tid 43050] [client 4.212.93.21:21402] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-good.php"] [unique_id "aepq6W6I0QqmmmLTHE2TrwAAAIc"]
[Fri Apr 24 02:54:35.674573 2026] [:error] [pid 42972:tid 43029] [client 4.212.93.21:4467] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class-t.api.php"] [unique_id "aepq68OAb-3sOknsk4fZogAAAE0"]
[Fri Apr 24 02:54:37.115409 2026] [:error] [pid 42971:tid 43002] [client 4.212.93.21:21406] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class-t.api.php"] [unique_id "aepq7TEP2_5RswrH8bFYswAAABA"]
[Fri Apr 24 02:54:38.525948 2026] [:error] [pid 64998:tid 65013] [client 4.212.93.21:22232] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class-t.api.php"] [unique_id "aepq7oV5EysYcTLjmwhQbwAAAcs"]
[Fri Apr 24 02:54:39.924019 2026] [:error] [pid 42973:tid 43063] [client 4.212.93.21:22676] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class-t.api.php"] [unique_id "aepq726I0QqmmmLTHE2TwQAAAJQ"]
[Fri Apr 24 02:54:40.885659 2026] [:error] [pid 42973:tid 43047] [client 4.212.93.21:22211] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/mk.php"] [unique_id "aepq8G6I0QqmmmLTHE2TxwAAAIQ"]
[Fri Apr 24 02:54:42.443524 2026] [:error] [pid 64967:tid 64991] [client 4.212.93.21:44777] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/mk.php"] [unique_id "aepq8oAV4GfOOdX8QzqhMQAAAZY"]
[Fri Apr 24 02:54:43.673113 2026] [:error] [pid 64967:tid 64976] [client 4.212.93.21:33404] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/mk.php"] [unique_id "aepq84AV4GfOOdX8QzqhMgAAAYc"]
[Fri Apr 24 02:54:44.887926 2026] [:error] [pid 64998:tid 65018] [client 4.212.93.21:53506] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/mk.php"] [unique_id "aepq9IV5EysYcTLjmwhQjAAAAdA"]
[Fri Apr 24 02:54:46.767508 2026] [:error] [pid 59700:tid 59706] [client 4.212.93.21:34040] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gettest.php"] [unique_id "aepq9pXyGZJFeAIDWtmEgAAAAUQ"]
[Fri Apr 24 02:54:49.774842 2026] [:error] [pid 42972:tid 43023] [client 4.212.93.21:33390] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gettest.php"] [unique_id "aepq-cOAb-3sOknsk4fZrgAAAEc"]
[Fri Apr 24 02:54:51.854712 2026] [:error] [pid 43083:tid 43104] [client 4.212.93.21:4846] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gettest.php"] [unique_id "aepq-zC5hrvNXosL83K22wAAANM"]
[Fri Apr 24 02:54:53.747763 2026] [:error] [pid 64998:tid 65014] [client 4.212.93.21:5036] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gettest.php"] [unique_id "aepq_YV5EysYcTLjmwhQsgAAAcw"]
[Fri Apr 24 02:54:56.707103 2026] [:error] [pid 64998:tid 65013] [client 4.212.93.21:4833] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a4.php"] [unique_id "aeprAIV5EysYcTLjmwhQxAAAAcs"]
[Fri Apr 24 02:54:58.131529 2026] [:error] [pid 65000:tid 65057] [client 4.212.93.21:40169] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a4.php"] [unique_id "aeprAr6vRb9j6psK2Zaj7QAAAhg"]
[Fri Apr 24 02:55:02.003139 2026] [:error] [pid 42972:tid 43028] [client 4.212.93.21:4434] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a4.php"] [unique_id "aeprBsOAb-3sOknsk4fZ3QAAAEw"]
[Fri Apr 24 02:55:07.438617 2026] [:error] [pid 65000:tid 65051] [client 4.212.93.21:39620] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a4.php"] [unique_id "aeprC76vRb9j6psK2ZakGwAAAhI"]
[Fri Apr 24 02:55:08.841042 2026] [:error] [pid 65000:tid 65053] [client 4.212.93.21:16453] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/retu11.PhP7"] [unique_id "aeprDL6vRb9j6psK2ZakHgAAAhQ"]
[Fri Apr 24 02:55:11.452123 2026] [:error] [pid 64998:tid 65025] [client 4.212.93.21:35102] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/retu11.PhP7"] [unique_id "aeprD4V5EysYcTLjmwhQ_wAAAdc"]
[Fri Apr 24 02:55:12.369096 2026] [:error] [pid 46953:tid 46969] [client 4.212.93.21:39064] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/retu11.PhP7"] [unique_id "aeprEEnlpdHh-P6wKbqFywAAAk0"]
[Fri Apr 24 02:55:14.827461 2026] [:error] [pid 59700:tid 59710] [client 4.212.93.21:49204] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/retu11.PhP7"] [unique_id "aeprEpXyGZJFeAIDWtmEqgAAAUg"]
[Fri Apr 24 02:55:17.134480 2026] [:error] [pid 65000:tid 65039] [client 4.212.93.21:53545] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/rip.php"] [unique_id "aeprFb6vRb9j6psK2ZakNAAAAgY"]
[Fri Apr 24 02:55:19.723843 2026] [:error] [pid 65000:tid 65031] [client 4.212.93.21:53543] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/rip.php"] [unique_id "aeprF76vRb9j6psK2ZakRAAAAgI"]
[Fri Apr 24 02:55:27.781721 2026] [:error] [pid 42973:tid 43046] [client 4.212.93.21:25701] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/admlo.php"] [unique_id "aeprH26I0QqmmmLTHE2T6AAAAIM"]
[Fri Apr 24 02:55:29.692844 2026] [:error] [pid 42972:tid 43034] [client 4.212.93.21:4585] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/admlo.php"] [unique_id "aeprIcOAb-3sOknsk4faAAAAAFI"]
[Fri Apr 24 02:55:32.758625 2026] [:error] [pid 64998:tid 65016] [client 4.212.93.21:25712] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/admlo.php"] [unique_id "aeprJIV5EysYcTLjmwhRGAAAAc4"]
[Fri Apr 24 02:55:36.118503 2026] [:error] [pid 64998:tid 65003] [client 4.212.93.21:34058] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/admlo.php"] [unique_id "aeprKIV5EysYcTLjmwhRHQAAAcE"]
[Fri Apr 24 02:55:39.782502 2026] [:error] [pid 64998:tid 65016] [client 4.212.93.21:34466] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gcqoa.php"] [unique_id "aeprK4V5EysYcTLjmwhRJgAAAc4"]
[Fri Apr 24 02:55:43.458361 2026] [:error] [pid 65000:tid 65043] [client 4.212.93.21:4677] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gcqoa.php"] [unique_id "aeprL76vRb9j6psK2Zak4QAAAgo"]
[Fri Apr 24 02:55:45.794353 2026] [:error] [pid 64967:tid 64989] [client 4.212.93.21:27497] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gcqoa.php"] [unique_id "aeprMYAV4GfOOdX8QzqhTwAAAZQ"]
[Fri Apr 24 02:55:47.411530 2026] [:error] [pid 42972:tid 43039] [client 4.212.93.21:19008] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gcqoa.php"] [unique_id "aeprM8OAb-3sOknsk4faDgAAAFc"]
[Fri Apr 24 02:55:48.977859 2026] [:error] [pid 59700:tid 59726] [client 4.212.93.21:27435] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xxx.php"] [unique_id "aeprNJXyGZJFeAIDWtmEuwAAAVg"]
[Fri Apr 24 02:55:51.390355 2026] [:error] [pid 42972:tid 43022] [client 4.212.93.21:24201] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xxx.php"] [unique_id "aeprN8OAb-3sOknsk4faEQAAAEY"]
[Fri Apr 24 02:55:54.048995 2026] [:error] [pid 42973:tid 43053] [client 4.212.93.21:24210] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xxx.php"] [unique_id "aeprOm6I0QqmmmLTHE2T_wAAAIo"]
[Fri Apr 24 02:55:56.017311 2026] [:error] [pid 42973:tid 43048] [client 4.212.93.21:4498] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xxx.php"] [unique_id "aeprPG6I0QqmmmLTHE2UAgAAAIU"]
[Fri Apr 24 02:55:58.456000 2026] [:error] [pid 43083:tid 43090] [client 4.212.93.21:43576] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/b.php"] [unique_id "aeprPjC5hrvNXosL83K3EQAAAMU"]
[Fri Apr 24 02:56:00.411646 2026] [:error] [pid 42972:tid 43031] [client 4.212.93.21:4315] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/b.php"] [unique_id "aeprQMOAb-3sOknsk4faIwAAAE8"]
[Fri Apr 24 02:56:02.302284 2026] [:error] [pid 42972:tid 43032] [client 4.212.93.21:4349] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/b.php"] [unique_id "aeprQsOAb-3sOknsk4faLgAAAFA"]
[Fri Apr 24 02:56:04.061510 2026] [:error] [pid 65000:tid 65054] [client 4.212.93.21:4497] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/b.php"] [unique_id "aeprRL6vRb9j6psK2ZalMwAAAhU"]
[Fri Apr 24 02:56:05.946191 2026] [:error] [pid 64998:tid 65016] [client 4.212.93.21:21770] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/grsiuk.php"] [unique_id "aeprRYV5EysYcTLjmwhRSgAAAc4"]
[Fri Apr 24 02:56:09.698776 2026] [:error] [pid 64998:tid 65012] [client 4.212.93.21:21813] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/grsiuk.php"] [unique_id "aeprSYV5EysYcTLjmwhRUAAAAco"]
[Fri Apr 24 02:56:20.235215 2026] [:error] [pid 59700:tid 59711] [client 4.212.93.21:4290] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/grsiuk.php"] [unique_id "aeprVJXyGZJFeAIDWtmE4wAAAUk"]
[Fri Apr 24 02:56:30.904643 2026] [:error] [pid 64998:tid 65006] [client 4.212.93.21:65262] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bolt.php"] [unique_id "aeprXoV5EysYcTLjmwhRdgAAAcQ"]
[Fri Apr 24 02:56:34.761500 2026] [:error] [pid 42972:tid 43018] [client 4.212.93.21:48593] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bolt.php"] [unique_id "aeprYsOAb-3sOknsk4faUgAAAEI"]
[Fri Apr 24 02:56:39.329666 2026] [:error] [pid 42972:tid 43027] [client 4.212.93.21:28685] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bolt.php"] [unique_id "aeprZ8OAb-3sOknsk4faWwAAAEs"]
[Fri Apr 24 02:56:51.919797 2026] [:error] [pid 42972:tid 43034] [client 4.212.93.21:23742] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gifclass.php"] [unique_id "aeprc8OAb-3sOknsk4faagAAAFI"]
[Fri Apr 24 02:56:59.717337 2026] [:error] [pid 65000:tid 65055] [client 4.212.93.21:23731] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gifclass.php"] [unique_id "aepre76vRb9j6psK2ZamKgAAAhY"]
[Fri Apr 24 02:57:01.472730 2026] [:error] [pid 64998:tid 65006] [client 4.212.93.21:25636] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/gifclass.php"] [unique_id "aeprfYV5EysYcTLjmwhRvwAAAcQ"]
[Fri Apr 24 02:57:02.420695 2026] [:error] [pid 42972:tid 43037] [client 4.212.93.21:21860] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ccs.php"] [unique_id "aeprfsOAb-3sOknsk4faeQAAAFU"]
[Fri Apr 24 02:57:03.318615 2026] [:error] [pid 65000:tid 65054] [client 4.212.93.21:21874] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ccs.php"] [unique_id "aeprf76vRb9j6psK2ZamMgAAAhU"]
[Fri Apr 24 02:57:03.937830 2026] [:error] [pid 65000:tid 65030] [client 4.212.93.21:28788] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ccs.php"] [unique_id "aeprf76vRb9j6psK2ZamNQAAAgE"]
[Fri Apr 24 02:57:05.419921 2026] [:error] [pid 42972:tid 43022] [client 4.212.93.21:16442] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ccs.php"] [unique_id "aeprgcOAb-3sOknsk4fagAAAAEY"]
[Fri Apr 24 02:57:06.622638 2026] [:error] [pid 42972:tid 43034] [client 4.212.93.21:28070] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/first.php"] [unique_id "aeprgsOAb-3sOknsk4fahAAAAFI"]
[Fri Apr 24 02:57:07.852378 2026] [:error] [pid 42971:tid 42996] [client 4.212.93.21:20604] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/first.php"] [unique_id "aeprgzEP2_5RswrH8bFZDQAAAAo"]
[Fri Apr 24 02:57:09.242026 2026] [:error] [pid 64998:tid 65023] [client 4.212.93.21:19475] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/first.php"] [unique_id "aeprhYV5EysYcTLjmwhR4AAAAdU"]
[Fri Apr 24 02:57:10.546144 2026] [:error] [pid 65000:tid 65038] [client 4.212.93.21:42800] [client 4.212.93.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/first.php"] [unique_id "aeprhr6vRb9j6psK2ZamRwAAAgU"]
[Fri Apr 24 03:49:32.082049 2026] [:error] [pid 53640:tid 53716] [client 136.113.104.206:47228] [client 136.113.104.206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aep3zPvGCeB_vkvt8gGbSwAAAIs"]
[Fri Apr 24 08:37:24.705788 2026] [:error] [pid 52129:tid 52135] [client 172.161.55.226:2856] [client 172.161.55.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "aeq7ROKCZKf8_u2LKiAShAAAAQI"]
[Fri Apr 24 09:26:01.032187 2026] [:error] [pid 52129:tid 52147] [client 43.134.234.47:59123] [client 43.134.234.47] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aerGqeKCZKf8_u2LKiBBewAAAQ4"]
[Fri Apr 24 10:32:05.722180 2026] [:error] [pid 17808:tid 17827] [client 194.26.192.182:59804] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aerWJearbOEFI8qshvI8FgAAAFE"]
[Fri Apr 24 10:32:06.230533 2026] [:error] [pid 17720:tid 17776] [client 194.26.192.182:60105] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aerWJuhlUs6BS3Ng7_WoTQAAANY"]
[Fri Apr 24 10:32:06.741948 2026] [:error] [pid 17719:tid 17751] [client 194.26.192.182:60418] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aerWJsTZ9gzEyL1BkPrHZQAAAJg"]
[Fri Apr 24 10:32:07.289428 2026] [:error] [pid 17720:tid 17758] [client 194.26.192.182:60819] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aerWJ-hlUs6BS3Ng7_WoXgAAAMQ"]
[Fri Apr 24 10:32:07.796666 2026] [:error] [pid 22114:tid 22120] [client 194.26.192.182:61220] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aerWJ4AuWGz3WlMQjodqVAAAAQM"]
[Fri Apr 24 15:28:53.635211 2026] [:error] [pid 17808:tid 17826] [client 177.104.200.188:31051] [client 177.104.200.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.104.200.188, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aesbtearbOEFI8qshvK38AAAAFA"]
[Fri Apr 24 16:02:48.177208 2026] [:error] [pid 17721:tid 17805] [client 94.247.172.129:4901] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.perthactive.com.au|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.perthactive.com.au"] [uri "/"] [unique_id "aesjqOFXXkLeyDnfk__y7wAAABg"]
[Fri Apr 24 17:58:38.579696 2026] [:error] [pid 17719:tid 17735] [client 34.58.239.158:52727] [client 34.58.239.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aes-zsTZ9gzEyL1BkPqHRgAAAIg"]
[Fri Apr 24 17:58:39.190504 2026] [:error] [pid 4177:tid 4208] [client 34.58.239.158:52066] [client 34.58.239.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aes-z32asKnvdrSe0x6mrAAAAZc"]
[Fri Apr 24 19:59:00.245737 2026] [:error] [pid 17808:tid 17831] [client 72.146.1.209:62082] [client 72.146.1.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "aetbBOarbOEFI8qshvIn1wAAAFU"]
[Fri Apr 24 20:55:03.698574 2026] [:error] [pid 4177:tid 4193] [client 195.178.110.241:50276] [client 195.178.110.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aetoJ32asKnvdrSe0x4RXgAAAYg"]
[Sat Apr 25 09:49:26.534142 2026] [:error] [pid 44320:tid 44358] [client 23.100.95.109:7839] [client 23.100.95.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 23.100.95.109, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "aewdpjmFqSpku_dij8iZKwAAAEI"]
[Sat Apr 25 09:49:31.302715 2026] [:error] [pid 44319:tid 44329] [client 23.100.95.109:4323] [client 23.100.95.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.100.95.109, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aewdq8zJPAVLUb2pWtJyygAAAAA"]
[Sat Apr 25 09:49:35.634891 2026] [autoindex:error] [pid 44319:tid 44331] [client 23.100.95.109:4316] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 09:49:36.385948 2026] [:error] [pid 44319:tid 44343] [client 23.100.95.109:4337] [client 23.100.95.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aewdsMzJPAVLUb2pWtJy0gAAAA4"]
[Sat Apr 25 09:49:37.938513 2026] [autoindex:error] [pid 46083:tid 46108] [client 23.100.95.109:6356] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 09:49:38.067442 2026] [autoindex:error] [pid 46083:tid 46093] [client 23.100.95.109:6356] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 09:49:38.950903 2026] [autoindex:error] [pid 44425:tid 44444] [client 23.100.95.109:4489] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 09:49:39.073961 2026] [autoindex:error] [pid 44425:tid 44446] [client 23.100.95.109:4489] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 10:21:42.607965 2026] [:error] [pid 44425:tid 44445] [client 223.224.21.205:56703] [client 223.224.21.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.224.21.205, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aewlNiUl-VlItvY2tR9YRQAAANI"]
[Sat Apr 25 21:13:13.969855 2026] [:error] [pid 59896:tid 59902] [client 182.253.240.88:6215] [client 182.253.240.88] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "aey96bLLzhtkd-OXUgDxdAAAAEI"]
[Sat Apr 25 21:13:17.966908 2026] [:error] [pid 59896:tid 59912] [client 182.253.240.88:6361] [client 182.253.240.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.253.240.88, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aey97bLLzhtkd-OXUgDxfQAAAEw"]
[Sat Apr 25 21:42:42.009273 2026] [autoindex:error] [pid 59985:tid 60001] [client 51.12.95.31:62192] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 21:42:47.744325 2026] [autoindex:error] [pid 3212:tid 3235] [client 51.12.95.31:47636] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 21:43:09.285393 2026] [autoindex:error] [pid 3212:tid 3236] [client 51.12.95.31:44616] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 21:44:39.711497 2026] [autoindex:error] [pid 59898:tid 59964] [client 51.12.95.31:47438] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 21:44:48.653171 2026] [autoindex:error] [pid 3212:tid 3229] [client 51.12.95.31:44621] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 21:44:50.550318 2026] [autoindex:error] [pid 3212:tid 3217] [client 51.12.95.31:61743] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 21:45:03.416832 2026] [:error] [pid 59896:tid 59908] [client 51.12.95.31:60052] [client 51.12.95.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aezFX7LLzhtkd-OXUgD6-gAAAEg"]
[Sat Apr 25 21:45:06.481712 2026] [autoindex:error] [pid 59896:tid 59902] [client 51.12.95.31:40315] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 21:45:28.723451 2026] [autoindex:error] [pid 59985:tid 60008] [client 51.12.95.31:44668] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 23:26:29.528208 2026] [autoindex:error] [pid 3212:tid 3237] [client 20.203.162.164:21288] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 23:26:42.020187 2026] [autoindex:error] [pid 59985:tid 60000] [client 20.203.162.164:23885] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 23:27:32.787838 2026] [autoindex:error] [pid 3212:tid 3221] [client 20.203.162.164:25134] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 23:29:03.512190 2026] [autoindex:error] [pid 59896:tid 59907] [client 20.203.162.164:23185] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 23:29:47.015493 2026] [autoindex:error] [pid 3212:tid 3233] [client 20.203.162.164:29768] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 23:29:50.016046 2026] [autoindex:error] [pid 3212:tid 3218] [client 20.203.162.164:32277] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 23:30:08.841537 2026] [:error] [pid 59896:tid 59915] [client 20.203.162.164:6572] [client 20.203.162.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aezeALLLzhtkd-OXUgAkEwAAAE8"]
[Sat Apr 25 23:30:12.656035 2026] [autoindex:error] [pid 59896:tid 59923] [client 20.203.162.164:8273] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 25 23:30:52.935782 2026] [autoindex:error] [pid 59897:tid 59943] [client 20.203.162.164:54298] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:04:12.066407 2026] [:error] [pid 59896:tid 59920] [client 74.249.155.150:5173] [client 74.249.155.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.249.155.150, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "aezl_LLLzhtkd-OXUgAzPAAAAFQ"]
[Sun Apr 26 00:04:14.395924 2026] [autoindex:error] [pid 59985:tid 60009] [client 74.249.155.150:5134] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:04:19.411173 2026] [autoindex:error] [pid 3212:tid 3222] [client 74.249.155.150:5764] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:04:20.655719 2026] [autoindex:error] [pid 3212:tid 3227] [client 74.249.155.150:5172] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:04:29.936109 2026] [:error] [pid 59897:tid 59948] [client 74.249.155.150:5773] [client 74.249.155.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aezmDfBrrkdzpEbmK4esIQAAAJU"]
[Sun Apr 26 00:04:32.154188 2026] [autoindex:error] [pid 3212:tid 3220] [client 74.249.155.150:5778] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:04:39.184717 2026] [:error] [pid 59896:tid 59910] [client 74.249.155.150:5760] [client 74.249.155.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aezmF7LLzhtkd-OXUgAzVQAAAEo"]
[Sun Apr 26 00:04:41.044800 2026] [autoindex:error] [pid 59896:tid 59917] [client 74.249.155.150:5780] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:04:42.323190 2026] [autoindex:error] [pid 59896:tid 59907] [client 74.249.155.150:5144] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/block/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:04:43.656998 2026] [:error] [pid 3212:tid 3225] [client 74.249.155.150:5204] [client 74.249.155.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aezmG_g-28TY8_YLtUeMqAAAAQs"]
[Sun Apr 26 00:04:53.757079 2026] [:error] [pid 3212:tid 3224] [client 74.249.155.150:5155] [client 74.249.155.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/index.php"] [unique_id "aezmJfg-28TY8_YLtUeMuQAAAQo"]
[Sun Apr 26 00:04:56.548952 2026] [autoindex:error] [pid 3212:tid 3226] [client 74.249.155.150:5197] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:04:59.205063 2026] [autoindex:error] [pid 59898:tid 59974] [client 74.249.155.150:5243] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:27:42.278069 2026] [autoindex:error] [pid 3212:tid 3223] [client 20.78.174.75:8782] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:27:43.609489 2026] [autoindex:error] [pid 59897:tid 59945] [client 20.78.174.75:8809] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:27:47.641774 2026] [autoindex:error] [pid 3212:tid 3233] [client 20.78.174.75:8810] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:27:50.926829 2026] [autoindex:error] [pid 3212:tid 3217] [client 20.78.174.75:5099] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:27:52.901095 2026] [autoindex:error] [pid 59897:tid 59929] [client 20.78.174.75:9358] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:27:53.578223 2026] [autoindex:error] [pid 3212:tid 3217] [client 20.78.174.75:8936] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:27:54.232734 2026] [autoindex:error] [pid 59896:tid 59906] [client 20.78.174.75:8944] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 00:48:14.435039 2026] [:error] [pid 3212:tid 3235] [client 212.47.78.126:50763] [client 212.47.78.126] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "aezwTvg-28TY8_YLtUejzwAAARU"]
[Sun Apr 26 00:48:15.027949 2026] [:error] [pid 3212:tid 3233] [client 212.47.78.126:51744] [client 212.47.78.126] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "aezwT_g-28TY8_YLtUej1gAAARM"]
[Sun Apr 26 00:48:15.613074 2026] [:error] [pid 3212:tid 3222] [client 212.47.78.126:58405] [client 212.47.78.126] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/media/system/js/core.js"] [unique_id "aezwT_g-28TY8_YLtUej2wAAAQg"]
[Sun Apr 26 05:30:16.590190 2026] [:error] [pid 8390:tid 8455] [client 193.42.99.212:37624] [client 193.42.99.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.42.99.212, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ae0yaIGPtFK_i9p5yxQJZwAAAIQ"]
[Sun Apr 26 06:21:34.351698 2026] [:error] [pid 8385:tid 8437] [client 212.47.78.126:62260] [client 212.47.78.126] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "ae0-bjOy7_J84Wx3-oxmbQAAAE0"]
[Sun Apr 26 06:21:34.903116 2026] [:error] [pid 31273:tid 31363] [client 212.47.78.126:64485] [client 212.47.78.126] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "ae0-bvhcNJEGrATcuEfTuwAAAVg"]
[Sun Apr 26 06:21:35.498285 2026] [:error] [pid 41906:tid 41912] [client 212.47.78.126:51137] [client 212.47.78.126] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/media/system/js/core.js"] [unique_id "ae0-bz3-0A3lxw9OXoAnHwAAAYQ"]
[Sun Apr 26 08:43:29.261225 2026] [autoindex:error] [pid 16574:tid 16631] [client 20.78.174.75:4729] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:29.386112 2026] [autoindex:error] [pid 16574:tid 16623] [client 20.78.174.75:4729] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:29.515475 2026] [autoindex:error] [pid 16574:tid 16608] [client 20.78.174.75:4729] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:30.169090 2026] [autoindex:error] [pid 22573:tid 22609] [client 20.78.174.75:4685] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:30.296035 2026] [autoindex:error] [pid 22573:tid 22618] [client 20.78.174.75:4685] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:30.545894 2026] [autoindex:error] [pid 22573:tid 22613] [client 20.78.174.75:4685] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:31.727446 2026] [autoindex:error] [pid 22573:tid 22620] [client 20.78.174.75:9101] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:31.854209 2026] [autoindex:error] [pid 22573:tid 22626] [client 20.78.174.75:9101] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:31.978857 2026] [autoindex:error] [pid 22573:tid 22628] [client 20.78.174.75:9101] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:33.681801 2026] [autoindex:error] [pid 8390:tid 8455] [client 20.78.174.75:4675] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:35.419965 2026] [:error] [pid 8390:tid 8472] [client 20.78.174.75:4718] [client 20.78.174.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "ae1ft4GPtFK_i9p5yxRH7QAAAJU"]
[Sun Apr 26 08:43:35.942980 2026] [autoindex:error] [pid 8390:tid 8457] [client 20.78.174.75:9095] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:36.086267 2026] [autoindex:error] [pid 8390:tid 8462] [client 20.78.174.75:9095] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:36.740466 2026] [autoindex:error] [pid 22573:tid 22627] [client 20.78.174.75:4723] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:36.865893 2026] [autoindex:error] [pid 22573:tid 22612] [client 20.78.174.75:4723] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:39.127804 2026] [autoindex:error] [pid 8390:tid 8460] [client 20.78.174.75:9122] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:39.251927 2026] [autoindex:error] [pid 8390:tid 8457] [client 20.78.174.75:9122] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:39.375278 2026] [autoindex:error] [pid 8390:tid 8475] [client 20.78.174.75:9122] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:40.560582 2026] [autoindex:error] [pid 16515:tid 16521] [client 20.78.174.75:4732] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:40.680320 2026] [:error] [pid 16515:tid 16528] [client 20.78.174.75:4732] [client 20.78.174.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "ae1fvFtDrUmgHSvpuLzXXwAAAko"]
[Sun Apr 26 08:43:41.217034 2026] [:error] [pid 22572:tid 22582] [client 20.78.174.75:4733] [client 20.78.174.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/interactivity-api/index.php"] [unique_id "ae1fvdXOViWCFU-pZzCFjAAAAUQ"]
[Sun Apr 26 08:43:41.740539 2026] [:error] [pid 8390:tid 8473] [client 20.78.174.75:9358] [client 20.78.174.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "ae1fvYGPtFK_i9p5yxRIAgAAAJY"]
[Sun Apr 26 08:43:42.223183 2026] [autoindex:error] [pid 22572:tid 22590] [client 20.78.174.75:4686] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:43:42.347342 2026] [autoindex:error] [pid 22572:tid 22581] [client 20.78.174.75:4686] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 16:25:16.095328 2026] [:error] [pid 8383:tid 8420] [client 20.111.17.80:52179] [client 20.111.17.80] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae3L7NFa2S3EsATMdWMETwAAABc"]
[Sun Apr 26 16:25:16.101629 2026] [:error] [pid 8383:tid 8401] [client 20.111.17.80:45642] [client 20.111.17.80] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae3L7NFa2S3EsATMdWMEUAAAAAQ"]
[Sun Apr 26 16:25:17.470527 2026] [:error] [pid 8383:tid 8397] [client 20.111.17.80:56094] [client 20.111.17.80] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae3L7dFa2S3EsATMdWMEVQAAAAA"]
[Sun Apr 26 16:25:17.497787 2026] [:error] [pid 8383:tid 8405] [client 20.111.17.80:52210] [client 20.111.17.80] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae3L7dFa2S3EsATMdWMEVgAAAAg"]
[Sun Apr 26 16:25:18.613135 2026] [:error] [pid 8383:tid 8411] [client 20.111.17.80:46680] [client 20.111.17.80] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae3L7tFa2S3EsATMdWMEXQAAAA4"]
[Sun Apr 26 16:25:19.160831 2026] [:error] [pid 8383:tid 8414] [client 20.111.17.80:51165] [client 20.111.17.80] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae3L79Fa2S3EsATMdWMEYAAAABE"]
[Sun Apr 26 16:25:19.605025 2026] [:error] [pid 8383:tid 8402] [client 20.111.17.80:46681] [client 20.111.17.80] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae3L79Fa2S3EsATMdWMEZAAAAAU"]
[Sun Apr 26 16:25:20.007983 2026] [:error] [pid 8383:tid 8397] [client 20.111.17.80:42681] [client 20.111.17.80] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae3L8NFa2S3EsATMdWMEZwAAAAA"]
[Mon Apr 27 03:12:53.105774 2026] [:error] [pid 22572:tid 22593] [client 20.219.12.30:5832] [client 20.219.12.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.219.12.30, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ae5jtdXOViWCFU-pZzBpFgAAAU8"]
[Mon Apr 27 03:12:58.499807 2026] [:error] [pid 8390:tid 8459] [client 20.219.12.30:6339] [client 20.219.12.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.219.12.30, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ae5juoGPtFK_i9p5yxTTXQAAAIg"]
[Mon Apr 27 03:13:04.832932 2026] [autoindex:error] [pid 22573:tid 22631] [client 20.219.12.30:5320] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 03:13:05.712258 2026] [:error] [pid 13137:tid 13164] [client 20.219.12.30:6365] [client 20.219.12.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ae5jwd0RB4J0o4h5neHkcAAAAhc"]
[Mon Apr 27 03:13:07.479272 2026] [autoindex:error] [pid 8390:tid 8458] [client 20.219.12.30:6397] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 03:13:07.618810 2026] [autoindex:error] [pid 8390:tid 8473] [client 20.219.12.30:6397] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 03:13:08.635852 2026] [autoindex:error] [pid 13137:tid 13144] [client 20.219.12.30:5502] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 03:13:08.781125 2026] [autoindex:error] [pid 13137:tid 13141] [client 20.219.12.30:5502] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 03:42:19.000951 2026] [:error] [pid 20334:tid 20342] [client 59.132.71.72:53490] [client 59.132.71.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.132.71.72, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ae5qmv2BrMOANWIKROWLhgAAAMQ"]
[Mon Apr 27 03:46:29.505873 2026] [:error] [pid 20187:tid 20283] [client 89.163.146.197:61150] [client 89.163.146.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/txets.php"] [unique_id "ae5rldz7LIKb-lSjmKkKcwAAAJc"], referer: www.google.com
[Mon Apr 27 11:26:16.762718 2026] [autoindex:error] [pid 10926:tid 10952] [client 75.119.128.178:52075] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Apr 27 13:51:52.703494 2026] [:error] [pid 62607:tid 62631] [client 34.55.86.97:65299] [client 34.55.86.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/media/system/js/core.js"] [unique_id "ae75eIXk80_zcPo33vevgQAAAFY"]
[Mon Apr 27 14:11:06.867417 2026] [autoindex:error] [pid 62607:tid 62610] [client 20.219.12.30:5888] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 14:11:07.015858 2026] [proxy_fcgi:error] [pid 62607:tid 62628] [client 20.219.12.30:5888] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 14:11:07.807600 2026] [autoindex:error] [pid 62511:tid 62596] [client 20.219.12.30:5915] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 14:11:48.208820 2026] [:error] [pid 62509:tid 62538] [client 20.219.12.30:6921] [client 20.219.12.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.219.12.30, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/images/wp-login.php"] [unique_id "ae7-JNwtbauadMz70GGKGQAAAJY"]
[Mon Apr 27 23:04:02.914542 2026] [:error] [pid 13523:tid 13531] [client 186.113.107.29:29288] [client 186.113.107.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.113.107.29, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ae964ueav51IXKv1ebEVowAAAIY"]
[Mon Apr 27 23:56:39.427405 2026] [autoindex:error] [pid 31555:tid 31562] [client 20.203.141.82:63673] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 23:56:45.573276 2026] [autoindex:error] [pid 13554:tid 13559] [client 20.203.141.82:65269] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 23:57:07.108938 2026] [autoindex:error] [pid 13465:tid 13519] [client 20.203.141.82:65271] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 23:57:40.040010 2026] [autoindex:error] [pid 13523:tid 13548] [client 20.203.141.82:62478] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 23:57:48.271191 2026] [autoindex:error] [pid 13465:tid 13509] [client 20.203.141.82:3028] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 23:57:49.716525 2026] [autoindex:error] [pid 13465:tid 13501] [client 20.203.141.82:62502] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 23:57:55.437791 2026] [:error] [pid 13554:tid 13561] [client 20.203.141.82:63646] [client 20.203.141.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ae-Hg3Jx87Dl-xMmL93EDAAAAMU"]
[Mon Apr 27 23:57:57.498928 2026] [autoindex:error] [pid 13523:tid 13530] [client 20.203.141.82:65270] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 23:58:10.432422 2026] [autoindex:error] [pid 13523:tid 13546] [client 20.203.141.82:62508] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 03:08:03.132200 2026] [:error] [pid 13554:tid 13569] [client 185.194.178.55:40377] [client 185.194.178.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.55, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ae-0E3Jx87Dl-xMmL930mQAAAM0"]
[Tue Apr 28 05:19:31.215221 2026] [:error] [pid 56602:tid 56618] [client 52.141.35.48:7938] [client 52.141.35.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.141.35.48, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ae_S4_CwhMxzNW_lZSwg4wAAAQ4"]
[Tue Apr 28 05:19:32.451082 2026] [autoindex:error] [pid 14578:tid 14623] [client 52.141.35.48:9180] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 05:19:34.951675 2026] [autoindex:error] [pid 56602:tid 56605] [client 52.141.35.48:11590] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 05:19:35.664490 2026] [autoindex:error] [pid 56602:tid 56617] [client 52.141.35.48:7951] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 05:19:39.904118 2026] [:error] [pid 14686:tid 14705] [client 52.141.35.48:4785] [client 52.141.35.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ae_S6--YPF1Xm7uiWQ4hFQAAANA"]
[Tue Apr 28 05:19:41.104416 2026] [autoindex:error] [pid 56602:tid 56620] [client 52.141.35.48:10900] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 05:19:45.210254 2026] [:error] [pid 14578:tid 14625] [client 52.141.35.48:4798] [client 52.141.35.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "ae_S8engo3AwIJgfSHH31QAAAEw"]
[Tue Apr 28 05:19:45.777161 2026] [autoindex:error] [pid 14579:tid 14651] [client 52.141.35.48:4677] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 05:19:46.518637 2026] [autoindex:error] [pid 14578:tid 14630] [client 52.141.35.48:4769] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/block/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 05:19:47.235128 2026] [:error] [pid 56602:tid 56604] [client 52.141.35.48:4778] [client 52.141.35.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "ae_S8_CwhMxzNW_lZSwhIwAAAQA"]
[Tue Apr 28 05:19:52.583193 2026] [:error] [pid 14686:tid 14701] [client 52.141.35.48:12331] [client 52.141.35.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/index.php"] [unique_id "ae_S-O-YPF1Xm7uiWQ4hKAAAAMw"]
[Tue Apr 28 05:19:53.762228 2026] [autoindex:error] [pid 56602:tid 56626] [client 52.141.35.48:12327] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 05:19:54.840414 2026] [autoindex:error] [pid 14578:tid 14627] [client 52.141.35.48:4727] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 11:44:46.244911 2026] [:error] [pid 2741:tid 2764] [client 20.203.150.235:13950] [client 20.203.150.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.203.150.235, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "afAtLvp92FeOz1h6ILxXGwAAAVI"]
[Tue Apr 28 11:44:55.405293 2026] [:error] [pid 2741:tid 2770] [client 20.203.150.235:13566] [client 20.203.150.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.203.150.235, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "afAtN_p92FeOz1h6ILxXMQAAAVg"]
[Tue Apr 28 11:45:04.036172 2026] [autoindex:error] [pid 2741:tid 2755] [client 20.203.150.235:22919] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 11:45:05.528898 2026] [:error] [pid 2741:tid 2759] [client 20.203.150.235:13097] [client 20.203.150.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "afAtQfp92FeOz1h6ILxXeAAAAU0"]
[Tue Apr 28 11:45:08.610371 2026] [autoindex:error] [pid 33776:tid 33829] [client 20.203.150.235:12333] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 11:45:08.864560 2026] [autoindex:error] [pid 33776:tid 33828] [client 20.203.150.235:12333] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 11:45:10.706547 2026] [autoindex:error] [pid 33775:tid 33788] [client 20.203.150.235:10660] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 11:45:10.979780 2026] [autoindex:error] [pid 33775:tid 33780] [client 20.203.150.235:10660] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 17:39:20.517397 2026] [:error] [pid 2741:tid 2764] [client 147.91.216.3:50313] [client 147.91.216.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.91.216.3, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "afCASPp92FeOz1h6ILzHiwAAAVI"]
[Tue Apr 28 19:35:16.293877 2026] [autoindex:error] [pid 50889:tid 50916] [client 68.221.203.83:39094] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 19:35:26.147876 2026] [autoindex:error] [pid 33864:tid 33887] [client 68.221.203.83:47690] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 19:36:13.225477 2026] [autoindex:error] [pid 33777:tid 33855] [client 68.221.203.83:36340] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 19:37:20.439381 2026] [autoindex:error] [pid 33776:tid 33819] [client 68.221.203.83:38130] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 19:37:38.516898 2026] [autoindex:error] [pid 2741:tid 2757] [client 68.221.203.83:26237] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 19:37:41.105351 2026] [autoindex:error] [pid 33864:tid 33878] [client 68.221.203.83:48378] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 19:37:59.009513 2026] [:error] [pid 33776:tid 33817] [client 68.221.203.83:38466] [client 68.221.203.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afCcF1-bEJ2CKP3iKAArsQAAAEk"]
[Tue Apr 28 19:38:02.963355 2026] [autoindex:error] [pid 33777:tid 33854] [client 68.221.203.83:40213] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 19:38:23.525382 2026] [autoindex:error] [pid 33775:tid 33797] [client 68.221.203.83:39097] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 29 01:54:22.290086 2026] [autoindex:error] [pid 33777:tid 33846] [client 62.171.160.12:58859] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Apr 29 12:06:27.230026 2026] [:error] [pid 61539:tid 61551] [client 112.198.224.45:39795] [client 112.198.224.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.198.224.45, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "afGDw13XmLvOLqFtXVEvWQAAAAg"]
[Wed Apr 29 15:28:57.998896 2026] [:error] [pid 44766:tid 44786] [client 45.119.85.39:60130] [client 45.119.85.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.85.39, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp/wp-login.php"] [unique_id "afGzOaVI9GtM_JyauAI3hwAAAZI"], referer: https://www.google.com
[Wed Apr 29 15:28:57.998981 2026] [:error] [pid 44766:tid 44786] [client 45.119.85.39:60130] [client 45.119.85.39] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 45.119.85.39 on wp-login.php, counter = 72"] [hostname "perthactive.com.au"] [uri "/wp/wp-login.php"] [unique_id "afGzOaVI9GtM_JyauAI3hwAAAZI"], referer: https://www.google.com
[Wed Apr 29 15:48:54.986126 2026] [:error] [pid 44860:tid 44870] [client 45.119.85.39:57474] [client 45.119.85.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.85.39, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wordpress/wp-login.php"] [unique_id "afG35kQ82el2g7ESJ16I_AAAAkg"], referer: https://www.google.com
[Wed Apr 29 15:48:54.986198 2026] [:error] [pid 44860:tid 44870] [client 45.119.85.39:57474] [client 45.119.85.39] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 45.119.85.39 on wp-login.php, counter = 246"] [hostname "perthactive.com.au"] [uri "/wordpress/wp-login.php"] [unique_id "afG35kQ82el2g7ESJ16I_AAAAkg"], referer: https://www.google.com
[Thu Apr 30 00:27:57.831429 2026] [:error] [pid 21536:tid 21552] [client 45.166.184.165:50604] [client 45.166.184.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.166.184.165, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "afIxjSREaVkH9P5H_LQ_SQAAAI4"]
[Thu Apr 30 04:27:01.775449 2026] [:error] [pid 18111:tid 18140] [client 83.37.52.142:60183] [client 83.37.52.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.37.52.142, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "afJplWctLbxB7Q1_oK14yAAAABI"]
[Thu Apr 30 09:12:58.222670 2026] [autoindex:error] [pid 52350:tid 52375] [client 4.211.173.68:27152] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 30 09:12:58.535545 2026] [autoindex:error] [pid 52350:tid 52365] [client 4.211.173.68:27152] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 30 11:49:55.092168 2026] [autoindex:error] [pid 52350:tid 52376] [client 161.97.158.68:59084] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Apr 30 21:49:39.499382 2026] [:error] [pid 6456:tid 6482] [client 88.151.33.51:1322] [client 88.151.33.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.env"] [unique_id "afNd80OBwsDodnkJK5xyHAAAAFg"]
[Thu Apr 30 21:49:39.499399 2026] [:error] [pid 5733:tid 5803] [client 88.151.33.51:1294] [client 88.151.33.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local"] [unique_id "afNd8_T55_Ioa9J2OpL44QAAAQ0"]
[Thu Apr 30 21:49:39.499838 2026] [:error] [pid 5820:tid 5837] [client 88.151.33.51:1318] [client 88.151.33.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/app/.env"] [unique_id "afNd8wyrLh3-LgH3Xv9bdwAAAA8"]
[Thu Apr 30 21:49:39.500114 2026] [:error] [pid 5731:tid 5755] [client 88.151.33.51:1280] [client 88.151.33.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "afNd8w8tX7TbSfYoUIxIvgAAAJQ"]
[Thu Apr 30 21:49:39.500487 2026] [:error] [pid 6456:tid 6458] [client 88.151.33.51:1334] [client 88.151.33.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/backend/.env"] [unique_id "afNd80OBwsDodnkJK5xyHQAAAEA"]
[Thu Apr 30 21:49:40.538113 2026] [:error] [pid 6456:tid 6476] [client 88.151.33.51:1306] [client 88.151.33.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production"] [unique_id "afNd9EOBwsDodnkJK5xyIAAAAFI"]
[Fri May 01 01:43:13.638785 2026] [:error] [pid 47620:tid 47651] [client 34.97.84.251:56488] [client 34.97.84.251] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "afOUsb9bO-ytgFJ2lwOC9AAAAZc"]
[Fri May 01 03:27:02.017367 2026] [:error] [pid 5733:tid 5802] [client 104.28.214.115:10841] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/style.php"] [unique_id "afOtBvT55_Ioa9J2OpIszwAAAQw"]
[Fri May 01 07:17:03.343588 2026] [:error] [pid 6046:tid 6088] [client 88.151.33.122:29672] [client 88.151.33.122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/app/.env"] [unique_id "afPi74yBrpmb1HMIbiTs9AAAAYQ"]
[Fri May 01 07:17:03.343887 2026] [:error] [pid 6046:tid 6090] [client 88.151.33.122:29678] [client 88.151.33.122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/api/.env"] [unique_id "afPi74yBrpmb1HMIbiTs9QAAAYY"]
[Fri May 01 07:17:03.344199 2026] [:error] [pid 6046:tid 6098] [client 88.151.33.122:29646] [client 88.151.33.122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env"] [unique_id "afPi74yBrpmb1HMIbiTs9wAAAY4"]
[Fri May 01 07:17:03.344887 2026] [:error] [pid 38014:tid 38038] [client 88.151.33.122:29656] [client 88.151.33.122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.production"] [unique_id "afPi71Hplhcdzdndjk0Q_QAAAA8"]
[Fri May 01 07:17:03.345045 2026] [:error] [pid 38014:tid 38029] [client 88.151.33.122:29648] [client 88.151.33.122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.local"] [unique_id "afPi71Hplhcdzdndjk0Q_gAAAAY"]
[Fri May 01 07:17:03.345644 2026] [:error] [pid 38014:tid 38033] [client 88.151.33.122:29694] [client 88.151.33.122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/backend/.env"] [unique_id "afPi71Hplhcdzdndjk0Q_wAAAAo"]
[Fri May 01 17:51:26.483010 2026] [:error] [pid 33791:tid 33800] [client 34.63.123.63:53085] [client 34.63.123.63] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "afR3nm9ixd-moLycM9DX8AAAAAY"]
[Fri May 01 17:51:27.169391 2026] [:error] [pid 33791:tid 33802] [client 34.63.123.63:54161] [client 34.63.123.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.63.123.63, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "afR3n29ixd-moLycM9DX8wAAAAg"]
[Fri May 01 19:40:22.601582 2026] [:error] [pid 24997:tid 25065] [client 160.176.61.129:11797] [client 160.176.61.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "afSRJvOkHa4ScY5oo8zKFgAAAMk"]
[Fri May 01 20:59:41.512874 2026] [:error] [pid 25085:tid 25104] [client 157.85.211.113:10970] [client 157.85.211.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.85.211.113, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "afSjvfuD8fWRiE0RX0ELjgAAAU0"]
[Sat May 02 05:13:31.545356 2026] [:error] [pid 53434:tid 53450] [client 35.193.123.228:52888] [client 35.193.123.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "afUXe-9BXmRQcbfsxlzHfQAAAAc"]
[Sat May 02 18:44:25.005527 2026] [:error] [pid 11894:tid 11920] [client 110.76.128.145:60732] [client 110.76.128.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.76.128.145, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "afXViTHh6DQF1tkXIKzPYgAAAVc"]
[Sat May 02 21:57:58.802203 2026] [:error] [pid 52012:tid 52080] [client 35.232.27.124:33578] [client 35.232.27.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "afYC5kzSWr-8cpS83mjAHAAAA0M"]
[Sat May 02 22:52:54.826904 2026] [autoindex:error] [pid 51950:tid 52004] [client 172.173.121.85:23437] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:52:55.500951 2026] [autoindex:error] [pid 51917:tid 51919] [client 172.173.121.85:22738] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:52:58.221839 2026] [autoindex:error] [pid 52010:tid 52055] [client 172.173.121.85:23510] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:52:59.010064 2026] [autoindex:error] [pid 53434:tid 53456] [client 172.173.121.85:22754] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:53:10.761279 2026] [autoindex:error] [pid 53434:tid 53458] [client 172.173.121.85:22774] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:53:11.002407 2026] [autoindex:error] [pid 52012:tid 52084] [client 172.173.121.85:23534] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:53:34.878113 2026] [autoindex:error] [pid 53435:tid 53477] [client 172.173.121.85:22769] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:53:35.701376 2026] [autoindex:error] [pid 52010:tid 52058] [client 172.173.121.85:23447] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:53:39.592766 2026] [autoindex:error] [pid 51917:tid 51926] [client 172.173.121.85:22777] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:53:40.814952 2026] [autoindex:error] [pid 52012:tid 52094] [client 172.173.121.85:23383] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:53:41.327921 2026] [autoindex:error] [pid 52010:tid 52062] [client 172.173.121.85:23414] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:53:42.405157 2026] [autoindex:error] [pid 53435:tid 53489] [client 172.173.121.85:23419] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:53:45.152213 2026] [:error] [pid 53435:tid 53480] [client 172.173.121.85:23322] [client 172.173.121.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afYP-YDmp7_z8QkjSzPhZgAAAEg"]
[Sat May 02 22:53:46.406907 2026] [autoindex:error] [pid 52010:tid 52055] [client 172.173.121.85:22775] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:53:46.796443 2026] [:error] [pid 52012:tid 52080] [client 172.173.121.85:23342] [client 172.173.121.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afYP-kzSWr-8cpS83mjV-gAAA0M"]
[Sat May 02 22:53:48.140071 2026] [autoindex:error] [pid 52012:tid 52099] [client 172.173.121.85:23393] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:53:56.352993 2026] [autoindex:error] [pid 51950:tid 51996] [client 172.173.121.85:23311] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 02 22:53:57.576501 2026] [autoindex:error] [pid 51917:tid 51928] [client 172.173.121.85:23324] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 11:27:27.414576 2026] [autoindex:error] [pid 40456:tid 40458] [client 172.173.121.85:1838] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 11:27:30.803655 2026] [autoindex:error] [pid 40422:tid 40438] [client 172.173.121.85:53974] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 11:27:43.659737 2026] [autoindex:error] [pid 37130:tid 37221] [client 172.173.121.85:53996] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 11:28:10.831126 2026] [autoindex:error] [pid 40422:tid 40449] [client 172.173.121.85:31041] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 11:28:15.941401 2026] [autoindex:error] [pid 40422:tid 40432] [client 172.173.121.85:1350] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 11:28:17.011532 2026] [autoindex:error] [pid 40422:tid 40431] [client 172.173.121.85:1229] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 11:28:21.213144 2026] [:error] [pid 37246:tid 37272] [client 172.173.121.85:1412] [client 172.173.121.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afbA1ThvYFGNwhnPamquxQAAARY"]
[Sun May 03 11:28:22.531397 2026] [autoindex:error] [pid 37126:tid 37159] [client 172.173.121.85:53979] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 11:28:32.961208 2026] [autoindex:error] [pid 37246:tid 37249] [client 172.173.121.85:1376] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 14:08:22.381778 2026] [:error] [pid 37246:tid 37257] [client 34.17.110.188:41142] [client 34.17.110.188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "afbmVjhvYFGNwhnPamrbOgAAAQk"]
[Sun May 03 16:28:07.376374 2026] [autoindex:error] [pid 54535:tid 54551] [client 62.171.160.12:61813] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun May 03 17:24:29.411355 2026] [:error] [pid 34432:tid 34452] [client 108.234.85.141:51402] [client 108.234.85.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.234.85.141, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "afcUTZ73JKVQ0wlof4I_0AAAAdI"]
[Sun May 03 19:56:34.448693 2026] [:error] [pid 34432:tid 34445] [client 114.119.134.123:21503] [client 114.119.134.123] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "afc38p73JKVQ0wlof4Jt_AAAAcs"], referer: https://perthactive.com.au/%E0%B8%A3%E0%B8%A7%E0%B8%A1%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx
[Mon May 04 00:23:25.467158 2026] [:error] [pid 37246:tid 37271] [client 34.158.44.14:52880] [client 34.158.44.14] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "afd2fThvYFGNwhnPampFXAAAARU"]
[Mon May 04 04:16:33.797098 2026] [:error] [pid 58625:tid 58649] [client 91.92.243.250:59543] [client 91.92.243.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.243.250, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "afetIfZfjPGFqq6KSLn2RAAAARU"]
[Mon May 04 09:54:41.151144 2026] [:error] [pid 33186:tid 33199] [client 20.9.90.138:16991] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class-t.api.php"] [unique_id "aff8Ybqlqe0DcmBS9VzuZwAAAAo"]
[Mon May 04 09:54:41.918655 2026] [:error] [pid 12051:tid 12069] [client 20.9.90.138:19717] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class-t.api.php"] [unique_id "aff8YerVB-w_PyOHK6leZQAAAVA"]
[Mon May 04 09:54:42.673637 2026] [:error] [pid 33186:tid 33210] [client 20.9.90.138:28187] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class-t.api.php"] [unique_id "aff8Yrqlqe0DcmBS9VzuqAAAABU"]
[Mon May 04 09:54:43.422691 2026] [:error] [pid 33186:tid 33210] [client 20.9.90.138:16997] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/class-t.api.php"] [unique_id "aff8Y7qlqe0DcmBS9VzuyQAAABU"]
[Mon May 04 13:46:13.870782 2026] [:error] [pid 12051:tid 12077] [client 167.88.166.186:52381] [client 167.88.166.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "afgyperVB-w_PyOHK6mYfQAAAVg"]
[Mon May 04 15:39:50.320422 2026] [:error] [pid 3341:tid 3366] [client 209.87.169.41:52067] [client 209.87.169.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "afhNRk9o3_LordU0wW7npAAAAJY"]
[Mon May 04 15:45:07.203333 2026] [:error] [pid 61042:tid 61055] [client 136.107.232.91:50605] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "afhOg0nAPPS1fjubA9Qq4gAAAMk"]
[Mon May 04 15:45:07.651513 2026] [:error] [pid 61043:tid 61089] [client 136.107.232.91:52700] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "afhOg58-LwtfURjiAbBqoQAAAE4"]
[Mon May 04 15:45:08.084251 2026] [:error] [pid 3341:tid 3345] [client 136.107.232.91:55597] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "afhOhE9o3_LordU0wW7qrAAAAIE"]
[Mon May 04 20:24:08.047287 2026] [:error] [pid 61044:tid 61107] [client 34.24.211.32:56515] [client 34.24.211.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "afiP6Ew8w2zZZXI6H1uYnwAAAAU"]
[Mon May 04 20:24:08.584106 2026] [:error] [pid 3341:tid 3359] [client 34.24.211.32:62031] [client 34.24.211.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "afiP6E9o3_LordU0wW5SiQAAAI8"]
[Mon May 04 20:24:09.071877 2026] [:error] [pid 3341:tid 3344] [client 34.24.211.32:64788] [client 34.24.211.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "afiP6U9o3_LordU0wW5SwwAAAIA"]
[Tue May 05 01:13:24.968600 2026] [:error] [pid 61042:tid 61052] [client 34.32.52.233:51238] [client 34.32.52.233] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "afjTtEnAPPS1fjubA9R9LwAAAMY"]
[Tue May 05 05:27:18.943006 2026] [:error] [pid 39073:tid 39153] [client 209.87.169.20:55929] [client 209.87.169.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.perthactive.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "afkPNv0kT1BNjk46BkcWgAAAAJM"]
[Tue May 05 07:46:43.161357 2026] [autoindex:error] [pid 39071:tid 39081] [client 45.86.200.54:53581] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:44.958722 2026] [autoindex:error] [pid 39071:tid 39087] [client 45.86.200.103:53995] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:50.684944 2026] [autoindex:error] [pid 53856:tid 53889] [client 45.86.200.59:59553] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:51.888173 2026] [autoindex:error] [pid 39071:tid 39085] [client 185.82.72.4:42403] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:53.854937 2026] [autoindex:error] [pid 53856:tid 53878] [client 45.86.200.110:42217] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:54.163712 2026] [autoindex:error] [pid 53856:tid 53876] [client 45.86.200.110:42217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:54.439459 2026] [autoindex:error] [pid 53856:tid 53869] [client 45.86.200.110:42217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:54.737084 2026] [autoindex:error] [pid 53856:tid 53870] [client 45.86.200.110:42217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/languages/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:55.338577 2026] [autoindex:error] [pid 53856:tid 53886] [client 45.86.200.110:42217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:55.624891 2026] [autoindex:error] [pid 53856:tid 53869] [client 45.86.200.110:42217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:55.912886 2026] [autoindex:error] [pid 53856:tid 53874] [client 45.86.200.110:42217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:56.204189 2026] [autoindex:error] [pid 53856:tid 53885] [client 45.86.200.110:42217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:56.484032 2026] [autoindex:error] [pid 53856:tid 53871] [client 45.86.200.110:42217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:56.780271 2026] [autoindex:error] [pid 53856:tid 53875] [client 45.86.200.110:42217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:57.363736 2026] [autoindex:error] [pid 53856:tid 53871] [client 45.86.200.110:42217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:57.673076 2026] [autoindex:error] [pid 53856:tid 53872] [client 45.86.200.110:42217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:46:57.967344 2026] [autoindex:error] [pid 53856:tid 53884] [client 45.86.200.110:42217] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:00.549684 2026] [autoindex:error] [pid 39073:tid 39154] [client 45.86.200.79:22553] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:00.879753 2026] [autoindex:error] [pid 39073:tid 39141] [client 45.86.200.79:22553] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:01.159562 2026] [autoindex:error] [pid 39073:tid 39152] [client 45.86.200.79:22553] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:01.445124 2026] [autoindex:error] [pid 39073:tid 39138] [client 45.86.200.79:22553] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:01.745893 2026] [autoindex:error] [pid 39073:tid 39156] [client 45.86.200.79:22553] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:02.043616 2026] [autoindex:error] [pid 39073:tid 39150] [client 45.86.200.79:22553] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:03.142992 2026] [autoindex:error] [pid 39071:tid 39097] [client 45.86.200.106:40247] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:03.432572 2026] [autoindex:error] [pid 39071:tid 39086] [client 45.86.200.106:40247] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:05.660107 2026] [autoindex:error] [pid 39073:tid 39147] [client 45.86.200.89:44859] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:07.229479 2026] [:error] [pid 41055:tid 41072] [client 45.86.200.60:50587] [client 45.86.200.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/light/"] [unique_id "afkv-yepFwKgA_SKOHgZ2AAAAQ4"]
[Tue May 05 07:47:07.791425 2026] [autoindex:error] [pid 53856:tid 53888] [client 45.86.200.58:61353] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:08.085409 2026] [autoindex:error] [pid 53856:tid 53887] [client 45.86.200.58:61353] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:08.367632 2026] [autoindex:error] [pid 53856:tid 53866] [client 45.86.200.58:61353] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:11.627166 2026] [autoindex:error] [pid 53856:tid 53872] [client 45.86.200.57:20661] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:11.906174 2026] [autoindex:error] [pid 53856:tid 53889] [client 45.86.200.57:20661] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:14.070977 2026] [autoindex:error] [pid 39071:tid 39095] [client 45.86.200.93:25361] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:15.132471 2026] [autoindex:error] [pid 39071:tid 39099] [client 45.86.200.75:34793] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:16.161251 2026] [autoindex:error] [pid 53856:tid 53877] [client 45.86.200.92:63623] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:16.437985 2026] [autoindex:error] [pid 53856:tid 53888] [client 45.86.200.92:63623] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:16.722400 2026] [autoindex:error] [pid 53856:tid 53867] [client 45.86.200.92:63623] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:17.007487 2026] [autoindex:error] [pid 53856:tid 53884] [client 45.86.200.92:63623] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:17.290947 2026] [autoindex:error] [pid 53856:tid 53879] [client 45.86.200.92:63623] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:18.934811 2026] [autoindex:error] [pid 41055:tid 41075] [client 45.86.200.107:39683] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:19.223813 2026] [autoindex:error] [pid 41055:tid 41080] [client 45.86.200.107:39683] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/random_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:20.182121 2026] [autoindex:error] [pid 39178:tid 39183] [client 45.86.200.108:29937] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:20.476877 2026] [autoindex:error] [pid 39178:tid 39184] [client 45.86.200.108:29937] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:23.092852 2026] [autoindex:error] [pid 39072:tid 39116] [client 45.86.200.100:43705] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:24.066960 2026] [autoindex:error] [pid 39071:tid 39104] [client 45.86.200.100:38039] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:25.742278 2026] [autoindex:error] [pid 41055:tid 41064] [client 45.86.200.107:21863] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:27.395845 2026] [autoindex:error] [pid 39073:tid 39148] [client 45.86.200.58:65249] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:28.440408 2026] [autoindex:error] [pid 39178:tid 39193] [client 45.86.200.80:33569] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:28.714250 2026] [autoindex:error] [pid 39178:tid 39194] [client 45.86.200.80:33569] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:29.010822 2026] [autoindex:error] [pid 39178:tid 39197] [client 45.86.200.80:33569] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:29.334714 2026] [autoindex:error] [pid 39178:tid 39184] [client 45.86.200.80:33569] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/themes/twentytwentytwo/assets/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:31.805519 2026] [proxy_fcgi:error] [pid 41055:tid 41065] [client 45.86.200.107:56303] AH01071: Got error 'PHP message: PHP Fatal error: Uncaught Error: Undefined constant "ABSPATH" in /home/perthactivecom/public_html/wp-includes/blocks/index.php:8\nStack trace:\n#0 {main}\n thrown in /home/perthactivecom/public_html/wp-includes/blocks/index.php on line 8'
[Tue May 05 07:47:34.054011 2026] [autoindex:error] [pid 53856:tid 53872] [client 185.82.72.3:34019] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:34.327481 2026] [autoindex:error] [pid 53856:tid 53877] [client 185.82.72.3:34019] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:34.673948 2026] [autoindex:error] [pid 53856:tid 53889] [client 185.82.72.3:34019] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:34.960147 2026] [autoindex:error] [pid 53856:tid 53871] [client 185.82.72.3:34019] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:39.614295 2026] [autoindex:error] [pid 39073:tid 39140] [client 45.86.200.109:46959] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:39.897336 2026] [autoindex:error] [pid 39073:tid 39134] [client 45.86.200.109:46959] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:40.179826 2026] [autoindex:error] [pid 39073:tid 39136] [client 45.86.200.109:46959] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:40.479754 2026] [autoindex:error] [pid 39073:tid 39135] [client 45.86.200.109:46959] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:40.762995 2026] [autoindex:error] [pid 39073:tid 39134] [client 45.86.200.109:46959] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:41.780683 2026] [autoindex:error] [pid 39178:tid 39185] [client 45.86.200.110:44563] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/Parse/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:42.798528 2026] [autoindex:error] [pid 39178:tid 39200] [client 45.86.200.56:46931] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/SimplePie/Cache/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:43.107692 2026] [autoindex:error] [pid 39178:tid 39202] [client 45.86.200.56:46931] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:43.409169 2026] [autoindex:error] [pid 39178:tid 39200] [client 45.86.200.56:46931] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/languages/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:47.185085 2026] [autoindex:error] [pid 39178:tid 39184] [client 45.86.200.55:62019] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:50.754662 2026] [autoindex:error] [pid 41055:tid 41070] [client 45.86.200.57:42185] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:51.030655 2026] [autoindex:error] [pid 41055:tid 41082] [client 45.86.200.57:42185] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:51.303456 2026] [autoindex:error] [pid 41055:tid 41074] [client 45.86.200.57:42185] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:51.570373 2026] [autoindex:error] [pid 41055:tid 41078] [client 45.86.200.57:42185] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:54.513958 2026] [autoindex:error] [pid 53856:tid 53884] [client 45.86.200.101:46645] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:58.831488 2026] [autoindex:error] [pid 41055:tid 41075] [client 45.86.200.112:30473] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:59.102434 2026] [autoindex:error] [pid 41055:tid 41069] [client 45.86.200.112:30473] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:05.661286 2026] [autoindex:error] [pid 53856:tid 53886] [client 45.86.200.74:25797] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:08.526046 2026] [autoindex:error] [pid 39073:tid 39136] [client 45.86.200.53:26907] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:08.808636 2026] [autoindex:error] [pid 39073:tid 39134] [client 45.86.200.53:26907] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:09.091699 2026] [autoindex:error] [pid 39073:tid 39140] [client 45.86.200.53:26907] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:10.770720 2026] [autoindex:error] [pid 41055:tid 41061] [client 45.86.200.101:22589] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/Auth/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:20.741809 2026] [autoindex:error] [pid 39178:tid 39201] [client 45.86.200.75:39637] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/Utility/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:22.803924 2026] [autoindex:error] [pid 39178:tid 39202] [client 45.86.200.103:27663] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/languages/plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:23.089821 2026] [autoindex:error] [pid 39178:tid 39180] [client 45.86.200.103:27663] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:25.891120 2026] [autoindex:error] [pid 39073:tid 39135] [client 45.86.200.90:21041] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:27.508151 2026] [autoindex:error] [pid 39178:tid 39185] [client 45.86.200.96:52809] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:29.092917 2026] [autoindex:error] [pid 53856:tid 53866] [client 45.86.200.87:50081] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:30.093811 2026] [autoindex:error] [pid 39073:tid 39150] [client 45.86.200.80:38461] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:30.403632 2026] [autoindex:error] [pid 39073:tid 39137] [client 45.86.200.80:38461] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:30.703593 2026] [autoindex:error] [pid 39073:tid 39136] [client 45.86.200.80:38461] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/wlw/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:30.996134 2026] [autoindex:error] [pid 39073:tid 39146] [client 45.86.200.80:38461] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:31.312002 2026] [autoindex:error] [pid 39073:tid 39148] [client 45.86.200.80:38461] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:31.604629 2026] [autoindex:error] [pid 39073:tid 39136] [client 45.86.200.80:38461] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:34.247105 2026] [autoindex:error] [pid 39072:tid 39127] [client 45.86.200.105:38709] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:36.015942 2026] [autoindex:error] [pid 39073:tid 39154] [client 45.86.200.87:26267] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:42.184735 2026] [autoindex:error] [pid 39072:tid 39116] [client 45.86.200.108:48751] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:43.218805 2026] [autoindex:error] [pid 53856:tid 53886] [client 45.86.200.106:60787] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:44.096654 2026] [autoindex:error] [pid 39072:tid 39120] [client 45.86.200.84:44565] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:51.077354 2026] [autoindex:error] [pid 53856:tid 53887] [client 45.86.200.76:23977] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:55.137422 2026] [autoindex:error] [pid 53856:tid 53889] [client 45.86.200.112:41615] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 12:54:06.323081 2026] [:error] [pid 25744:tid 25779] [client 136.185.20.82:54440] [client 136.185.20.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.185.20.82, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "afl37iR8IuyzjkW06OORhgAAAIU"]
[Wed May 06 00:16:32.747618 2026] [:error] [pid 2324:tid 2341] [client 40.83.73.145:8312] [client 40.83.73.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/function/function.php"] [unique_id "afoX4Gqe2hrcI52A1HzKmgAAAU8"]
[Wed May 06 00:16:33.285098 2026] [:error] [pid 25744:tid 25774] [client 40.83.73.145:8308] [client 40.83.73.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/function/function.php"] [unique_id "afoX4SR8IuyzjkW06OMdlwAAAIA"]
[Wed May 06 00:16:33.845803 2026] [:error] [pid 2324:tid 2343] [client 40.83.73.145:6571] [client 40.83.73.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/function/function.php"] [unique_id "afoX4Wqe2hrcI52A1HzKngAAAVE"]
[Wed May 06 00:16:34.484772 2026] [:error] [pid 25835:tid 25842] [client 40.83.73.145:6534] [client 40.83.73.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/function/function.php"] [unique_id "afoX4lDT5nGJyh1439wBpgAAAQU"]
[Wed May 06 07:36:24.445304 2026] [:error] [pid 13414:tid 13439] [client 129.222.135.26:1999] [client 129.222.135.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.222.135.26, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "afp--EuJQpWjVpJTu_nPsgAAARc"]
[Wed May 06 09:59:19.989021 2026] [:error] [pid 9659:tid 9744] [client 104.248.174.184:57247] [client 104.248.174.184] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.174.184, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "afqgd_wJnWjd8JHpBttMXwAAAMo"]
[Wed May 06 10:29:20.826629 2026] [:error] [pid 9653:tid 9718] [client 147.182.159.90:64876] [client 147.182.159.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 147.182.159.90, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "afqngKhJ49Xc4dqq0B5q8AAAABQ"]
[Wed May 06 15:10:58.910559 2026] [:error] [pid 9664:tid 9776] [client 173.239.214.24:64963] [client 173.239.214.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "afrpggH4OZbrg1SjsBMbRQAAAI4"]
[Wed May 06 19:10:17.424857 2026] [:error] [pid 557:tid 564] [client 194.233.87.198:45618] [client 194.233.87.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.233.87.198, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "afshmTZjFR8Vd8ce80ApKAAAAkU"]
[Wed May 06 19:10:26.379630 2026] [:error] [pid 9664:tid 9772] [client 194.233.87.198:45628] [client 194.233.87.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.233.87.198, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "afshogH4OZbrg1SjsBM5VgAAAIo"]
[Thu May 07 03:29:47.015734 2026] [:error] [pid 9653:tid 9710] [client 134.209.102.117:55521] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/dump.sql"] [unique_id "afuWq6hJ49Xc4dqq0B6SiwAAAAw"]
[Thu May 07 03:29:47.015736 2026] [:error] [pid 9664:tid 9770] [client 134.209.102.117:55524] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/localhost.sql"] [unique_id "afuWqwH4OZbrg1SjsBObiQAAAIg"]
[Thu May 07 03:29:47.017038 2026] [:error] [pid 9653:tid 9714] [client 134.209.102.117:55518] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/db_backup.sql"] [unique_id "afuWq6hJ49Xc4dqq0B6SjAAAABA"]
[Thu May 07 03:29:47.017083 2026] [:error] [pid 9664:tid 9763] [client 134.209.102.117:55522] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".com.au.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au.sql"] [unique_id "afuWqwH4OZbrg1SjsBObiwAAAIE"]
[Thu May 07 03:29:47.017132 2026] [:error] [pid 9664:tid 9775] [client 134.209.102.117:55517] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/data.sql"] [unique_id "afuWqwH4OZbrg1SjsBObigAAAI0"]
[Thu May 07 03:29:47.017458 2026] [:error] [pid 482:tid 494] [client 134.209.102.117:55515] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/backup.sql"] [unique_id "afuWq8xs8HOc_nWgOW65CQAAAco"]
[Thu May 07 03:29:47.018530 2026] [:error] [pid 9664:tid 9781] [client 134.209.102.117:55495] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/1.sql"] [unique_id "afuWqwH4OZbrg1SjsBObjAAAAJM"]
[Thu May 07 03:29:47.018846 2026] [:error] [pid 9664:tid 9774] [client 134.209.102.117:55516] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/database.sql"] [unique_id "afuWqwH4OZbrg1SjsBObjQAAAIw"]
[Thu May 07 03:29:47.018942 2026] [:error] [pid 9664:tid 9766] [client 134.209.102.117:55523] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".com.au_db.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/perthactive.com.au_db.sql"] [unique_id "afuWqwH4OZbrg1SjsBObjgAAAIQ"]
[Thu May 07 03:29:47.019637 2026] [:error] [pid 9653:tid 9699] [client 134.209.102.117:55520] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/db.sql"] [unique_id "afuWq6hJ49Xc4dqq0B6SjQAAAAE"]
[Thu May 07 03:29:47.019891 2026] [:error] [pid 9659:tid 9746] [client 134.209.102.117:55519] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/dbdump.sql"] [unique_id "afuWq_wJnWjd8JHpBtvH7QAAAMw"]
[Thu May 07 03:29:47.021444 2026] [:error] [pid 9664:tid 9762] [client 134.209.102.117:55532] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/www.sql"] [unique_id "afuWqwH4OZbrg1SjsBObjwAAAIA"]
[Thu May 07 03:29:47.021483 2026] [:error] [pid 9653:tid 9703] [client 134.209.102.117:55534] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/wp-content/mysql.sql"] [unique_id "afuWq6hJ49Xc4dqq0B6SjgAAAAU"]
[Thu May 07 03:29:47.022415 2026] [:error] [pid 9653:tid 9700] [client 134.209.102.117:55526] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/mysql.sql"] [unique_id "afuWq6hJ49Xc4dqq0B6SjwAAAAI"]
[Thu May 07 03:29:47.022572 2026] [:error] [pid 9653:tid 9717] [client 134.209.102.117:55525] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/mysqldump.sql"] [unique_id "afuWq6hJ49Xc4dqq0B6SkAAAABM"]
[Thu May 07 03:29:47.023273 2026] [:error] [pid 9653:tid 9722] [client 134.209.102.117:55527] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/site.sql"] [unique_id "afuWq6hJ49Xc4dqq0B6SkQAAABg"]
[Thu May 07 03:29:47.024093 2026] [:error] [pid 482:tid 507] [client 134.209.102.117:55531] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/users.sql"] [unique_id "afuWq8xs8HOc_nWgOW65CgAAAdU"]
[Thu May 07 03:29:47.025198 2026] [:error] [pid 557:tid 568] [client 134.209.102.117:55528] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/sql.sql"] [unique_id "afuWqzZjFR8Vd8ce80BJ7gAAAkk"]
[Thu May 07 03:29:47.025426 2026] [:error] [pid 9653:tid 9705] [client 134.209.102.117:55533] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/dump.sql"] [unique_id "afuWq6hJ49Xc4dqq0B6SkgAAAAc"]
[Thu May 07 03:29:47.025743 2026] [:error] [pid 13443:tid 13452] [client 134.209.102.117:55529] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/temp.sql"] [unique_id "afuWqwCyfZallDmsQre_6QAAAUc"]
[Thu May 07 03:29:47.026478 2026] [:error] [pid 13443:tid 13450] [client 134.209.102.117:55530] [client 134.209.102.117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/translate.sql"] [unique_id "afuWqwCyfZallDmsQre_6gAAAUU"]
[Thu May 07 11:54:17.293861 2026] [:error] [pid 56150:tid 56152] [client 72.62.212.232:55480] [client 72.62.212.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "afwM6du4duXJJeTigXQwSwAAAEA"]
[Thu May 07 12:22:14.392958 2026] [:error] [pid 56064:tid 56093] [client 45.133.5.205:43473] [client 45.133.5.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "afwTdisGkZZUEf_7QCMmYAAAABg"]
[Thu May 07 12:22:14.604406 2026] [:error] [pid 1143:tid 1154] [client 45.133.5.229:57379] [client 45.133.5.229] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/inputs.php"] [unique_id "afwTdpb7qeI8X5VYRr544gAAAQk"]
[Thu May 07 12:22:14.867554 2026] [:error] [pid 1143:tid 1163] [client 45.133.5.169:57135] [client 45.133.5.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/admin.php"] [unique_id "afwTdpb7qeI8X5VYRr545AAAARI"]
[Thu May 07 12:22:15.078345 2026] [:error] [pid 1143:tid 1152] [client 45.133.5.180:60489] [client 45.133.5.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "afwTd5b7qeI8X5VYRr545gAAAQc"]
[Thu May 07 12:22:15.289790 2026] [:error] [pid 1143:tid 1150] [client 45.133.5.169:39797] [client 45.133.5.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/users.php"] [unique_id "afwTd5b7qeI8X5VYRr545wAAAQU"]
[Thu May 07 12:22:15.501610 2026] [:error] [pid 1143:tid 1153] [client 45.133.5.209:53971] [client 45.133.5.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/adminfuns.php"] [unique_id "afwTd5b7qeI8X5VYRr546gAAAQg"]
[Thu May 07 12:22:15.767026 2026] [:error] [pid 1143:tid 1169] [client 45.133.5.209:26247] [client 45.133.5.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403.php"] [unique_id "afwTd5b7qeI8X5VYRr547AAAARg"]
[Thu May 07 12:22:15.978369 2026] [:error] [pid 56150:tid 56157] [client 45.133.5.182:41741] [client 45.133.5.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/"] [unique_id "afwTd9u4duXJJeTigXQ6TQAAAEU"]
[Thu May 07 12:22:16.192200 2026] [:error] [pid 56150:tid 56161] [client 45.133.5.221:47643] [client 45.133.5.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "afwTeNu4duXJJeTigXQ6TwAAAEk"]
[Thu May 07 12:22:16.402990 2026] [:error] [pid 1143:tid 1158] [client 45.133.5.182:54499] [client 45.133.5.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/3PJcpMFsD8B.php"] [unique_id "afwTeJb7qeI8X5VYRr547gAAAQ0"]
[Thu May 07 12:22:16.614973 2026] [:error] [pid 56150:tid 56154] [client 45.133.5.210:46069] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/goods.php"] [unique_id "afwTeNu4duXJJeTigXQ6UAAAAEI"]
[Thu May 07 12:22:16.854839 2026] [:error] [pid 56150:tid 56167] [client 45.133.5.219:32569] [client 45.133.5.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "afwTeNu4duXJJeTigXQ6UQAAAE8"]
[Thu May 07 12:22:17.065385 2026] [:error] [pid 1143:tid 1145] [client 45.133.5.162:33889] [client 45.133.5.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/"] [unique_id "afwTeZb7qeI8X5VYRr548AAAAQA"]
[Thu May 07 12:22:17.278250 2026] [:error] [pid 56066:tid 56147] [client 45.133.5.220:48001] [client 45.133.5.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/posts"] [unique_id "afwTeUYS8DGwDvklLv6yjAAAANg"]
[Thu May 07 12:22:17.490136 2026] [:error] [pid 56066:tid 56132] [client 45.133.5.184:56871] [client 45.133.5.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/"] [unique_id "afwTeUYS8DGwDvklLv6yjQAAAMk"]
[Thu May 07 12:22:17.701625 2026] [:error] [pid 56064:tid 56091] [client 45.133.5.212:33125] [client 45.133.5.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/admin.php"] [unique_id "afwTeSsGkZZUEf_7QCMmYQAAABY"]
[Thu May 07 12:22:17.914705 2026] [:error] [pid 56150:tid 56173] [client 45.133.5.169:23005] [client 45.133.5.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "afwTedu4duXJJeTigXQ6VgAAAFU"]
[Thu May 07 12:22:18.173434 2026] [:error] [pid 56150:tid 56171] [client 45.133.5.191:63413] [client 45.133.5.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/assets/images/selam.php"] [unique_id "afwTetu4duXJJeTigXQ6WAAAAFM"]
[Thu May 07 12:22:18.384029 2026] [:error] [pid 56066:tid 56142] [client 45.133.5.210:35755] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/item.php"] [unique_id "afwTekYS8DGwDvklLv6yjgAAANM"]
[Thu May 07 12:22:18.595505 2026] [:error] [pid 56066:tid 56146] [client 45.133.5.175:34175] [client 45.133.5.175] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hello-plus/classes/ehp-sarang.php"] [unique_id "afwTekYS8DGwDvklLv6yjwAAANc"]
[Thu May 07 12:22:18.808899 2026] [:error] [pid 56066:tid 56143] [client 45.133.5.200:49811] [client 45.133.5.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/admin.php"] [unique_id "afwTekYS8DGwDvklLv6ykAAAANQ"]
[Thu May 07 12:22:19.055507 2026] [:error] [pid 56150:tid 56172] [client 45.133.5.164:50247] [client 45.133.5.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-config-sample.php"] [unique_id "afwTe9u4duXJJeTigXQ6WgAAAFQ"]
[Thu May 07 12:22:19.267165 2026] [:error] [pid 56150:tid 56166] [client 45.133.5.210:27423] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/admin/"] [unique_id "afwTe9u4duXJJeTigXQ6XAAAAE4"]
[Thu May 07 12:22:19.484298 2026] [:error] [pid 56064:tid 56077] [client 45.133.5.177:61383] [client 45.133.5.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/404.php"] [unique_id "afwTeysGkZZUEf_7QCMmYgAAAAg"]
[Thu May 07 12:22:19.698680 2026] [:error] [pid 56064:tid 56075] [client 45.133.5.180:41635] [client 45.133.5.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/edit-tags.php"] [unique_id "afwTeysGkZZUEf_7QCMmYwAAAAY"]
[Thu May 07 12:22:20.076179 2026] [:error] [pid 56064:tid 56076] [client 45.133.5.212:20245] [client 45.133.5.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/system.php"] [unique_id "afwTfCsGkZZUEf_7QCMmZgAAAAc"]
[Thu May 07 12:22:20.295663 2026] [:error] [pid 56150:tid 56167] [client 45.133.5.169:42475] [client 45.133.5.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/"] [unique_id "afwTfNu4duXJJeTigXQ6XgAAAE8"]
[Thu May 07 12:22:20.802730 2026] [:error] [pid 56150:tid 56173] [client 45.133.5.171:54793] [client 45.133.5.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/.well-known/core.php"] [unique_id "afwTfNu4duXJJeTigXQ6YQAAAFU"]
[Thu May 07 12:22:21.195445 2026] [:error] [pid 56150:tid 56159] [client 45.133.5.197:38339] [client 45.133.5.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-wlx.php"] [unique_id "afwTfdu4duXJJeTigXQ6YwAAAEc"]
[Thu May 07 12:22:21.672076 2026] [:error] [pid 56064:tid 56090] [client 45.133.5.210:56043] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/updates.php"] [unique_id "afwTfSsGkZZUEf_7QCMmZwAAABU"]
[Thu May 07 12:22:23.591686 2026] [:error] [pid 56066:tid 56134] [client 45.133.5.184:29603] [client 45.133.5.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/speculative8.php"] [unique_id "afwTf0YS8DGwDvklLv6ylQAAAMs"]
[Thu May 07 12:22:23.804464 2026] [:error] [pid 56065:tid 56114] [client 45.133.5.179:55853] [client 45.133.5.179] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/classwithtostring.php"] [unique_id "afwTf3dV4hYThdnhfxDbFQAAAJI"]
[Thu May 07 12:22:24.053864 2026] [:error] [pid 1143:tid 1162] [client 45.133.5.212:35167] [client 45.133.5.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/PHPMailer/s"] [unique_id "afwTgJb7qeI8X5VYRr54-AAAARE"]
[Thu May 07 12:22:24.272508 2026] [:error] [pid 56150:tid 56173] [client 45.133.5.195:61975] [client 45.133.5.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/1.php"] [unique_id "afwTgNu4duXJJeTigXQ6ZQAAAFU"]
[Thu May 07 12:22:24.486919 2026] [:error] [pid 56150:tid 56171] [client 45.133.5.229:30281] [client 45.133.5.229] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/"] [unique_id "afwTgNu4duXJJeTigXQ6ZgAAAFM"]
[Thu May 07 12:22:24.699568 2026] [:error] [pid 56150:tid 56163] [client 45.133.5.229:20077] [client 45.133.5.229] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/shell/"] [unique_id "afwTgNu4duXJJeTigXQ6aAAAAEs"]
[Thu May 07 12:22:24.911602 2026] [:error] [pid 1143:tid 1146] [client 45.133.5.165:35625] [client 45.133.5.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/about.php"] [unique_id "afwTgJb7qeI8X5VYRr54-QAAAQE"]
[Thu May 07 12:22:25.156215 2026] [:error] [pid 56066:tid 56126] [client 45.133.5.222:64065] [client 45.133.5.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/mah.php"] [unique_id "afwTgUYS8DGwDvklLv6ylgAAAMM"]
[Thu May 07 12:22:25.369978 2026] [:error] [pid 56065:tid 56098] [client 45.133.5.189:42503] [client 45.133.5.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "afwTgXdV4hYThdnhfxDbFwAAAII"]
[Thu May 07 12:22:25.581851 2026] [:error] [pid 56064:tid 56085] [client 45.133.5.180:62923] [client 45.133.5.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/news-portal/sitebar.php"] [unique_id "afwTgSsGkZZUEf_7QCMmaAAAABA"]
[Thu May 07 12:22:25.795298 2026] [:error] [pid 1143:tid 1168] [client 45.133.5.187:20213] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp.php"] [unique_id "afwTgZb7qeI8X5VYRr54-gAAARc"]
[Thu May 07 12:22:26.009064 2026] [:error] [pid 1143:tid 1158] [client 45.133.5.178:50707] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/"] [unique_id "afwTgpb7qeI8X5VYRr54-wAAAQ0"]
[Thu May 07 12:22:26.220086 2026] [:error] [pid 56065:tid 56104] [client 45.133.5.187:62427] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/x.php"] [unique_id "afwTgndV4hYThdnhfxDbGAAAAIg"]
[Thu May 07 12:22:26.462068 2026] [:error] [pid 1143:tid 1148] [client 45.133.5.224:37777] [client 45.133.5.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afwTgpb7qeI8X5VYRr54_AAAAQM"]
[Thu May 07 12:22:26.677382 2026] [:error] [pid 1143:tid 1150] [client 45.133.5.187:41703] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/plugins/"] [unique_id "afwTgpb7qeI8X5VYRr54_QAAAQU"]
[Thu May 07 12:22:27.055871 2026] [:error] [pid 56066:tid 56124] [client 45.133.5.197:54385] [client 45.133.5.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/"] [unique_id "afwTg0YS8DGwDvklLv6ymAAAAME"]
[Thu May 07 12:22:27.389651 2026] [:error] [pid 56066:tid 56141] [client 45.133.5.167:22697] [client 45.133.5.167] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/fukasawa/inc/classes/403.php"] [unique_id "afwTg0YS8DGwDvklLv6ymQAAANI"]
[Thu May 07 12:22:29.290902 2026] [:error] [pid 56065:tid 56105] [client 45.133.5.205:47601] [client 45.133.5.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "afwThXdV4hYThdnhfxDbHQAAAIk"]
[Thu May 07 12:22:29.504420 2026] [:error] [pid 56064:tid 56088] [client 45.133.5.165:51079] [client 45.133.5.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/system_core.php"] [unique_id "afwThSsGkZZUEf_7QCMmaQAAABM"]
[Thu May 07 12:22:29.715733 2026] [:error] [pid 56150:tid 56169] [client 45.133.5.203:34507] [client 45.133.5.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/222.php"] [unique_id "afwThdu4duXJJeTigXQ6awAAAFE"]
[Thu May 07 12:22:29.957096 2026] [:error] [pid 56150:tid 56157] [client 45.133.5.169:27823] [client 45.133.5.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/"] [unique_id "afwThdu4duXJJeTigXQ6bAAAAEU"]
[Thu May 07 12:22:30.173522 2026] [:error] [pid 1143:tid 1157] [client 45.133.5.187:22075] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/"] [unique_id "afwThpb7qeI8X5VYRr55AQAAAQw"]
[Thu May 07 12:22:30.393424 2026] [:error] [pid 1143:tid 1166] [client 45.133.5.164:49871] [client 45.133.5.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/edit.php"] [unique_id "afwThpb7qeI8X5VYRr55AwAAARU"]
[Thu May 07 12:22:30.659068 2026] [:error] [pid 1143:tid 1149] [client 45.133.5.180:30393] [client 45.133.5.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin.php"] [unique_id "afwThpb7qeI8X5VYRr55BwAAAQQ"]
[Thu May 07 12:22:30.871738 2026] [:error] [pid 56065:tid 56117] [client 45.133.5.214:35473] [client 45.133.5.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/"] [unique_id "afwThndV4hYThdnhfxDbJQAAAJU"]
[Thu May 07 12:22:31.085686 2026] [:error] [pid 1143:tid 1167] [client 45.133.5.165:45467] [client 45.133.5.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/components/"] [unique_id "afwTh5b7qeI8X5VYRr55DAAAARY"]
[Thu May 07 12:22:31.298169 2026] [:error] [pid 56064:tid 56086] [client 45.133.5.164:63137] [client 45.133.5.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/images/"] [unique_id "afwThysGkZZUEf_7QCMmagAAABE"]
[Thu May 07 12:22:31.508996 2026] [:error] [pid 56150:tid 56153] [client 45.133.5.228:62759] [client 45.133.5.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/radio.php"] [unique_id "afwTh9u4duXJJeTigXQ6dAAAAEE"]
[Thu May 07 12:22:31.754380 2026] [:error] [pid 1143:tid 1154] [client 45.133.5.205:65143] [client 45.133.5.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/archives/"] [unique_id "afwTh5b7qeI8X5VYRr55EwAAAQk"]
[Thu May 07 12:22:31.964439 2026] [:error] [pid 56064:tid 56093] [client 45.133.5.187:51287] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "afwThysGkZZUEf_7QCMmawAAABg"]
[Thu May 07 12:22:32.184302 2026] [:error] [pid 56066:tid 56140] [client 45.133.5.207:29385] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/php-compat/"] [unique_id "afwTiEYS8DGwDvklLv6ypwAAANE"]
[Thu May 07 12:22:32.395219 2026] [:error] [pid 1143:tid 1168] [client 45.133.5.222:51035] [client 45.133.5.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/"] [unique_id "afwTiJb7qeI8X5VYRr55GwAAARc"]
[Thu May 07 12:22:32.654768 2026] [:error] [pid 1143:tid 1150] [client 45.133.5.214:33351] [client 45.133.5.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afwTiJb7qeI8X5VYRr55HwAAAQU"]
[Thu May 07 12:22:32.865937 2026] [:error] [pid 1143:tid 1165] [client 45.133.5.162:48539] [client 45.133.5.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bless.php"] [unique_id "afwTiJb7qeI8X5VYRr55IwAAARQ"]
[Thu May 07 12:22:33.078688 2026] [:error] [pid 56064:tid 56084] [client 45.133.5.200:56389] [client 45.133.5.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/main_json.php"] [unique_id "afwTiSsGkZZUEf_7QCMmbAAAAA8"]
[Thu May 07 12:22:33.289646 2026] [:error] [pid 56064:tid 56091] [client 45.133.5.178:33019] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/modern/test2.php"] [unique_id "afwTiSsGkZZUEf_7QCMmbQAAABY"]
[Thu May 07 12:22:33.501792 2026] [:error] [pid 56066:tid 56142] [client 45.133.5.187:50549] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/info.php"] [unique_id "afwTiUYS8DGwDvklLv6yrAAAANM"]
[Thu May 07 12:22:33.713141 2026] [:error] [pid 56150:tid 56160] [client 45.133.5.207:61285] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-file.php"] [unique_id "afwTidu4duXJJeTigXQ6eQAAAEg"]
[Thu May 07 12:22:33.958879 2026] [:error] [pid 56150:tid 56169] [client 45.133.5.171:30933] [client 45.133.5.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade/"] [unique_id "afwTidu4duXJJeTigXQ6egAAAFE"]
[Thu May 07 12:22:34.170654 2026] [:error] [pid 56150:tid 56166] [client 45.133.5.171:36577] [client 45.133.5.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/index/function.php"] [unique_id "afwTitu4duXJJeTigXQ6fAAAAE4"]
[Thu May 07 12:22:34.381904 2026] [:error] [pid 56150:tid 56162] [client 45.133.5.219:53317] [client 45.133.5.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/light/"] [unique_id "afwTitu4duXJJeTigXQ6fQAAAEo"]
[Thu May 07 12:22:34.594429 2026] [:error] [pid 56150:tid 56164] [client 45.133.5.185:59023] [client 45.133.5.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/about.php"] [unique_id "afwTitu4duXJJeTigXQ6fgAAAEw"]
[Thu May 07 12:22:34.807942 2026] [:error] [pid 56150:tid 56167] [client 45.133.5.219:51151] [client 45.133.5.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/plugin/"] [unique_id "afwTitu4duXJJeTigXQ6gQAAAE8"]
[Thu May 07 12:22:35.057351 2026] [:error] [pid 56065:tid 56113] [client 45.133.5.177:43547] [client 45.133.5.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/chosen.php"] [unique_id "afwTi3dV4hYThdnhfxDbLAAAAJE"]
[Thu May 07 12:22:35.270378 2026] [:error] [pid 56150:tid 56173] [client 45.133.5.224:46659] [client 45.133.5.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-bindings/"] [unique_id "afwTi9u4duXJJeTigXQ6ggAAAFU"]
[Thu May 07 12:22:35.483048 2026] [:error] [pid 56150:tid 56156] [client 45.133.5.220:55643] [client 45.133.5.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-good.php"] [unique_id "afwTi9u4duXJJeTigXQ6gwAAAEQ"]
[Thu May 07 12:22:35.693483 2026] [:error] [pid 56150:tid 56159] [client 45.133.5.171:63941] [client 45.133.5.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "afwTi9u4duXJJeTigXQ6hAAAAEc"]
[Thu May 07 12:22:35.905564 2026] [:error] [pid 56150:tid 56165] [client 45.133.5.181:50267] [client 45.133.5.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403x.php"] [unique_id "afwTi9u4duXJJeTigXQ6hQAAAE0"]
[Thu May 07 12:22:36.158042 2026] [:error] [pid 56150:tid 56155] [client 45.133.5.195:32447] [client 45.133.5.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bolt.php"] [unique_id "afwTjNu4duXJJeTigXQ6hgAAAEM"]
[Thu May 07 12:22:36.370349 2026] [:error] [pid 1143:tid 1163] [client 45.133.5.192:42419] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "afwTjJb7qeI8X5VYRr55KAAAARI"]
[Thu May 07 12:22:36.581484 2026] [:error] [pid 56150:tid 56175] [client 45.133.5.184:53225] [client 45.133.5.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/"] [unique_id "afwTjNu4duXJJeTigXQ6hwAAAFc"]
[Thu May 07 12:22:36.792577 2026] [:error] [pid 1143:tid 1149] [client 45.133.5.188:56043] [client 45.133.5.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/config.php"] [unique_id "afwTjJb7qeI8X5VYRr55KQAAAQQ"]
[Thu May 07 12:22:37.003615 2026] [:error] [pid 56066:tid 56141] [client 45.133.5.196:34539] [client 45.133.5.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/header.php"] [unique_id "afwTjUYS8DGwDvklLv6yrgAAANI"]
[Thu May 07 12:22:37.215702 2026] [:error] [pid 1143:tid 1169] [client 45.133.5.202:49131] [client 45.133.5.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hello.php"] [unique_id "afwTjZb7qeI8X5VYRr55KgAAARg"]
[Thu May 07 12:22:37.462702 2026] [:error] [pid 1143:tid 1159] [client 45.133.5.165:35107] [client 45.133.5.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/pullquote/"] [unique_id "afwTjZb7qeI8X5VYRr55KwAAAQ4"]
[Thu May 07 12:22:37.674547 2026] [:error] [pid 1143:tid 1150] [client 45.133.5.177:56855] [client 45.133.5.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/2024/"] [unique_id "afwTjZb7qeI8X5VYRr55LAAAAQU"]
[Thu May 07 12:22:37.886374 2026] [:error] [pid 56150:tid 56166] [client 45.133.5.177:36807] [client 45.133.5.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/src/Core/"] [unique_id "afwTjdu4duXJJeTigXQ6igAAAE4"]
[Thu May 07 12:22:38.098357 2026] [:error] [pid 1143:tid 1164] [client 45.133.5.179:47713] [client 45.133.5.179] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/widgets/"] [unique_id "afwTjpb7qeI8X5VYRr55LQAAARM"]
[Thu May 07 12:22:38.309880 2026] [:error] [pid 56065:tid 56105] [client 45.133.5.228:39691] [client 45.133.5.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/.well-known/"] [unique_id "afwTjndV4hYThdnhfxDbLQAAAIk"]
[Thu May 07 12:22:38.556598 2026] [:error] [pid 56066:tid 56123] [client 45.133.5.202:58557] [client 45.133.5.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/filester/assets/css/404.php"] [unique_id "afwTjkYS8DGwDvklLv6ysAAAAMA"]
[Thu May 07 12:22:38.769083 2026] [:error] [pid 56066:tid 56128] [client 45.133.5.209:23789] [client 45.133.5.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ws.php"] [unique_id "afwTjkYS8DGwDvklLv6ysQAAAMU"]
[Thu May 07 12:22:38.980746 2026] [:error] [pid 56150:tid 56162] [client 45.133.5.187:50203] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/simple.php"] [unique_id "afwTjtu4duXJJeTigXQ6iwAAAEo"]
[Thu May 07 12:22:39.195417 2026] [:error] [pid 1143:tid 1165] [client 45.133.5.183:22979] [client 45.133.5.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/"] [unique_id "afwTj5b7qeI8X5VYRr55LgAAARQ"]
[Thu May 07 12:22:39.407925 2026] [:error] [pid 56150:tid 56158] [client 45.133.5.222:24079] [client 45.133.5.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "afwTj9u4duXJJeTigXQ6jAAAAEY"]
[Thu May 07 12:22:39.619501 2026] [:error] [pid 1143:tid 1162] [client 45.133.5.202:53537] [client 45.133.5.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/edit-post/"] [unique_id "afwTj5b7qeI8X5VYRr55LwAAARE"]
[Thu May 07 12:22:39.858022 2026] [:error] [pid 1143:tid 1160] [client 45.133.5.178:59091] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/"] [unique_id "afwTj5b7qeI8X5VYRr55MgAAAQ8"]
[Thu May 07 12:22:40.069374 2026] [:error] [pid 1143:tid 1146] [client 45.133.5.181:26487] [client 45.133.5.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afwTkJb7qeI8X5VYRr55MwAAAQE"]
[Thu May 07 12:22:40.281176 2026] [:error] [pid 1143:tid 1157] [client 45.133.5.190:28857] [client 45.133.5.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/themes.php"] [unique_id "afwTkJb7qeI8X5VYRr55NAAAAQw"]
[Thu May 07 12:22:40.491470 2026] [:error] [pid 56066:tid 56134] [client 45.133.5.216:40727] [client 45.133.5.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/as.php"] [unique_id "afwTkEYS8DGwDvklLv6yswAAAMs"]
[Thu May 07 12:22:40.704804 2026] [:error] [pid 56065:tid 56108] [client 45.133.5.220:41799] [client 45.133.5.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/buy.php"] [unique_id "afwTkHdV4hYThdnhfxDbLgAAAIw"]
[Thu May 07 12:22:40.953756 2026] [:error] [pid 56064:tid 56079] [client 45.133.5.162:35439] [client 45.133.5.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/"] [unique_id "afwTkCsGkZZUEf_7QCMmcAAAAAo"]
[Thu May 07 12:22:41.165221 2026] [:error] [pid 1143:tid 1149] [client 45.133.5.192:27611] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wa/"] [unique_id "afwTkZb7qeI8X5VYRr55NQAAAQQ"]
[Thu May 07 12:22:41.379145 2026] [:error] [pid 1143:tid 1158] [client 45.133.5.221:53827] [client 45.133.5.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/"] [unique_id "afwTkZb7qeI8X5VYRr55NgAAAQ0"]
[Thu May 07 12:22:41.591929 2026] [:error] [pid 56066:tid 56139] [client 45.133.5.202:24987] [client 45.133.5.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/404.php"] [unique_id "afwTkUYS8DGwDvklLv6ytAAAANA"]
[Thu May 07 12:22:41.803111 2026] [:error] [pid 1143:tid 1167] [client 45.133.5.222:39783] [client 45.133.5.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ahax.php"] [unique_id "afwTkZb7qeI8X5VYRr55OQAAARY"]
[Thu May 07 12:22:42.014349 2026] [:error] [pid 56066:tid 56140] [client 45.133.5.208:40093] [client 45.133.5.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/buy.php"] [unique_id "afwTkkYS8DGwDvklLv6ytQAAANE"]
[Thu May 07 12:22:42.268471 2026] [:error] [pid 56066:tid 56127] [client 45.133.5.164:26275] [client 45.133.5.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/comment-date/"] [unique_id "afwTkkYS8DGwDvklLv6ytgAAAMQ"]
[Thu May 07 12:22:43.489537 2026] [:error] [pid 1143:tid 1165] [client 45.133.5.209:38705] [client 45.133.5.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "afwTk5b7qeI8X5VYRr55OwAAARQ"]
[Thu May 07 12:22:43.700722 2026] [:error] [pid 1143:tid 1162] [client 45.133.5.228:20359] [client 45.133.5.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/admin.php"] [unique_id "afwTk5b7qeI8X5VYRr55PQAAARE"]
[Thu May 07 12:22:43.912515 2026] [:error] [pid 56150:tid 56174] [client 45.133.5.164:39573] [client 45.133.5.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/fields/"] [unique_id "afwTk9u4duXJJeTigXQ6kQAAAFY"]
[Thu May 07 12:22:44.174027 2026] [:error] [pid 56150:tid 56171] [client 45.133.5.179:30461] [client 45.133.5.179] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/log.php"] [unique_id "afwTlNu4duXJJeTigXQ6kgAAAFM"]
[Thu May 07 12:22:44.496497 2026] [:error] [pid 56066:tid 56137] [client 45.133.5.192:56649] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/themes/about.php"] [unique_id "afwTlEYS8DGwDvklLv6yuQAAAM4"]
[Thu May 07 12:22:44.802713 2026] [:error] [pid 1143:tid 1160] [client 45.133.5.219:57539] [client 45.133.5.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "afwTlJb7qeI8X5VYRr55PwAAAQ8"]
[Thu May 07 12:22:45.054321 2026] [:error] [pid 56066:tid 56146] [client 45.133.5.189:31919] [client 45.133.5.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/"] [unique_id "afwTlUYS8DGwDvklLv6yugAAANc"]
[Thu May 07 12:22:45.266855 2026] [:error] [pid 56066:tid 56131] [client 45.133.5.205:44819] [client 45.133.5.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "afwTlUYS8DGwDvklLv6yuwAAAMg"]
[Thu May 07 12:22:45.477907 2026] [:error] [pid 1143:tid 1154] [client 45.133.5.178:65191] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/mini.php"] [unique_id "afwTlZb7qeI8X5VYRr55QQAAAQk"]
[Thu May 07 12:22:45.691827 2026] [:error] [pid 56065:tid 56101] [client 45.133.5.191:62503] [client 45.133.5.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/panel.php"] [unique_id "afwTlXdV4hYThdnhfxDbMAAAAIU"]
[Thu May 07 12:22:45.904400 2026] [:error] [pid 56066:tid 56128] [client 45.133.5.225:25143] [client 45.133.5.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/"] [unique_id "afwTlUYS8DGwDvklLv6yvAAAAMU"]
[Thu May 07 12:22:46.115791 2026] [:error] [pid 1143:tid 1159] [client 45.133.5.184:30669] [client 45.133.5.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/root.php"] [unique_id "afwTlpb7qeI8X5VYRr55QgAAAQ4"]
[Thu May 07 12:22:46.351932 2026] [:error] [pid 1143:tid 1167] [client 45.133.5.200:64407] [client 45.133.5.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/dist/development/"] [unique_id "afwTlpb7qeI8X5VYRr55QwAAARY"]
[Thu May 07 12:22:46.563834 2026] [:error] [pid 1143:tid 1152] [client 45.133.5.194:55813] [client 45.133.5.194] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/network/"] [unique_id "afwTlpb7qeI8X5VYRr55RAAAAQc"]
[Thu May 07 12:22:46.778655 2026] [:error] [pid 1143:tid 1165] [client 45.133.5.202:20695] [client 45.133.5.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/m.php"] [unique_id "afwTlpb7qeI8X5VYRr55RQAAARQ"]
[Thu May 07 12:22:46.993711 2026] [:error] [pid 1143:tid 1151] [client 45.133.5.170:64263] [client 45.133.5.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/admin/function.php"] [unique_id "afwTlpb7qeI8X5VYRr55RwAAAQY"]
[Thu May 07 12:22:47.204815 2026] [:error] [pid 56066:tid 56136] [client 45.133.5.210:41307] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/code/"] [unique_id "afwTl0YS8DGwDvklLv6yvQAAAM0"]
[Thu May 07 12:22:47.455700 2026] [:error] [pid 56066:tid 56138] [client 45.133.5.214:30291] [client 45.133.5.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "afwTl0YS8DGwDvklLv6yvwAAAM8"]
[Thu May 07 12:22:47.669563 2026] [:error] [pid 56066:tid 56126] [client 45.133.5.179:56303] [client 45.133.5.179] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/comments-pagination-numbers/"] [unique_id "afwTl0YS8DGwDvklLv6ywAAAAMM"]
[Thu May 07 12:22:47.881089 2026] [:error] [pid 1143:tid 1160] [client 45.133.5.200:32253] [client 45.133.5.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/a.php"] [unique_id "afwTl5b7qeI8X5VYRr55SgAAAQ8"]
[Thu May 07 12:22:48.093793 2026] [:error] [pid 1143:tid 1146] [client 45.133.5.182:25047] [client 45.133.5.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/includes/"] [unique_id "afwTmJb7qeI8X5VYRr55SwAAAQE"]
[Thu May 07 12:22:48.305200 2026] [:error] [pid 1143:tid 1161] [client 45.133.5.162:41123] [client 45.133.5.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/themes/"] [unique_id "afwTmJb7qeI8X5VYRr55TAAAARA"]
[Thu May 07 12:22:48.514927 2026] [:error] [pid 56066:tid 56147] [client 45.133.5.192:34221] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/footnotes/"] [unique_id "afwTmEYS8DGwDvklLv6ywgAAANg"]
[Thu May 07 12:22:48.762196 2026] [:error] [pid 56066:tid 56137] [client 45.133.5.162:22659] [client 45.133.5.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/midnight/"] [unique_id "afwTmEYS8DGwDvklLv6ywwAAAM4"]
[Thu May 07 12:22:48.973443 2026] [:error] [pid 1143:tid 1169] [client 45.133.5.220:63309] [client 45.133.5.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "afwTmJb7qeI8X5VYRr55TgAAARg"]
[Thu May 07 12:22:49.186353 2026] [:error] [pid 1143:tid 1168] [client 45.133.5.173:26251] [client 45.133.5.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/lib/"] [unique_id "afwTmZb7qeI8X5VYRr55TwAAARc"]
[Thu May 07 12:22:50.906856 2026] [:error] [pid 56064:tid 56085] [client 45.133.5.224:43645] [client 45.133.5.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/upload.php"] [unique_id "afwTmisGkZZUEf_7QCMmcwAAABA"]
[Thu May 07 12:22:51.157019 2026] [:error] [pid 1143:tid 1152] [client 45.133.5.187:33323] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-domain.php"] [unique_id "afwTm5b7qeI8X5VYRr55UQAAAQc"]
[Thu May 07 12:22:51.367975 2026] [:error] [pid 56066:tid 56143] [client 45.133.5.230:60713] [client 45.133.5.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/radio.php"] [unique_id "afwTm0YS8DGwDvklLv6yxwAAANQ"]
[Thu May 07 12:22:51.579558 2026] [:error] [pid 1143:tid 1164] [client 45.133.5.173:45947] [client 45.133.5.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/rip.php"] [unique_id "afwTm5b7qeI8X5VYRr55UgAAARM"]
[Thu May 07 12:22:51.791764 2026] [:error] [pid 1143:tid 1147] [client 45.133.5.207:39337] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/fukasawa/inc/classes/403x.php"] [unique_id "afwTm5b7qeI8X5VYRr55UwAAAQI"]
[Thu May 07 12:22:52.002878 2026] [:error] [pid 1143:tid 1146] [client 45.133.5.214:26273] [client 45.133.5.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/options.php"] [unique_id "afwTnJb7qeI8X5VYRr55VQAAAQE"]
[Thu May 07 12:22:52.214873 2026] [:error] [pid 1143:tid 1163] [client 45.133.5.185:35771] [client 45.133.5.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/config.php"] [unique_id "afwTnJb7qeI8X5VYRr55VgAAARI"]
[Thu May 07 12:22:52.427035 2026] [:error] [pid 56066:tid 56129] [client 45.133.5.210:35117] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/src/Content/Type/"] [unique_id "afwTnEYS8DGwDvklLv6yyAAAAMY"]
[Thu May 07 12:22:52.654982 2026] [:error] [pid 56150:tid 56154] [client 45.133.5.208:39771] [client 45.133.5.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/css.php"] [unique_id "afwTnNu4duXJJeTigXQ6mAAAAEI"]
[Thu May 07 12:22:52.869773 2026] [:error] [pid 56065:tid 56103] [client 45.133.5.229:26517] [client 45.133.5.229] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/freeform/"] [unique_id "afwTnHdV4hYThdnhfxDbMwAAAIc"]
[Thu May 07 12:22:53.081349 2026] [:error] [pid 56065:tid 56110] [client 45.133.5.216:63705] [client 45.133.5.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "afwTnXdV4hYThdnhfxDbNQAAAI4"]
[Thu May 07 12:22:53.294546 2026] [:error] [pid 56065:tid 56097] [client 45.133.5.221:58235] [client 45.133.5.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/system_log.php"] [unique_id "afwTnXdV4hYThdnhfxDbNgAAAIE"]
[Thu May 07 12:22:53.506102 2026] [:error] [pid 56150:tid 56156] [client 45.133.5.210:57453] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/neve/assets/apps/dashboard/build/"] [unique_id "afwTndu4duXJJeTigXQ6ngAAAEQ"]
[Thu May 07 12:22:53.756201 2026] [:error] [pid 56065:tid 56120] [client 45.133.5.207:56989] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/"] [unique_id "afwTnXdV4hYThdnhfxDbOAAAAJg"]
[Thu May 07 12:22:53.967420 2026] [:error] [pid 56065:tid 56107] [client 45.133.5.181:32359] [client 45.133.5.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "afwTnXdV4hYThdnhfxDbOQAAAIs"]
[Thu May 07 12:22:54.177447 2026] [:error] [pid 56066:tid 56134] [client 45.133.5.210:33727] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/ocean/"] [unique_id "afwTnkYS8DGwDvklLv6yyQAAAMs"]
[Thu May 07 12:22:54.394766 2026] [:error] [pid 56066:tid 56127] [client 45.133.5.209:56565] [client 45.133.5.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/"] [unique_id "afwTnkYS8DGwDvklLv6yywAAAMQ"]
[Thu May 07 12:22:54.607503 2026] [:error] [pid 56065:tid 56109] [client 45.133.5.170:37661] [client 45.133.5.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/comment-content/"] [unique_id "afwTnndV4hYThdnhfxDbQAAAAI0"]
[Thu May 07 12:22:54.852779 2026] [:error] [pid 56150:tid 56154] [client 45.133.5.169:25491] [client 45.133.5.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/"] [unique_id "afwTntu4duXJJeTigXQ6rAAAAEI"]
[Thu May 07 12:22:55.069250 2026] [:error] [pid 56065:tid 56114] [client 45.133.5.182:29779] [client 45.133.5.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/worksec.php"] [unique_id "afwTn3dV4hYThdnhfxDbQgAAAJI"]
[Thu May 07 12:22:55.280178 2026] [:error] [pid 56150:tid 56165] [client 45.133.5.185:23927] [client 45.133.5.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/packed.php"] [unique_id "afwTn9u4duXJJeTigXQ6uQAAAE0"]
[Thu May 07 12:22:55.492156 2026] [:error] [pid 56066:tid 56144] [client 45.133.5.206:48571] [client 45.133.5.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/network/cache/"] [unique_id "afwTn0YS8DGwDvklLv6y1QAAANU"]
[Thu May 07 12:22:55.703039 2026] [:error] [pid 56066:tid 56123] [client 45.133.5.188:40933] [client 45.133.5.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyfour/patterns/file.php"] [unique_id "afwTn0YS8DGwDvklLv6y1gAAAMA"]
[Thu May 07 12:22:55.915812 2026] [:error] [pid 56064:tid 56083] [client 45.133.5.167:23057] [client 45.133.5.167] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/admin-header.php"] [unique_id "afwTnysGkZZUEf_7QCMmdQAAAA4"]
[Thu May 07 12:22:56.155684 2026] [:error] [pid 56065:tid 56118] [client 45.133.5.179:62287] [client 45.133.5.179] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/details/"] [unique_id "afwToHdV4hYThdnhfxDbSgAAAJY"]
[Thu May 07 12:22:56.378071 2026] [:error] [pid 56064:tid 56091] [client 45.133.5.170:55075] [client 45.133.5.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/endpoints/"] [unique_id "afwToCsGkZZUEf_7QCMmdgAAABY"]
[Thu May 07 12:22:56.601615 2026] [:error] [pid 56064:tid 56072] [client 45.133.5.188:23469] [client 45.133.5.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/"] [unique_id "afwToCsGkZZUEf_7QCMmdwAAAAM"]
[Thu May 07 12:22:56.813315 2026] [:error] [pid 56064:tid 56078] [client 45.133.5.192:31477] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/mah/function.php"] [unique_id "afwToCsGkZZUEf_7QCMmeQAAAAk"]
[Thu May 07 12:22:57.052682 2026] [:error] [pid 56065:tid 56106] [client 45.133.5.202:53629] [client 45.133.5.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "afwToXdV4hYThdnhfxDbTwAAAIo"]
[Thu May 07 12:22:57.267927 2026] [:error] [pid 56065:tid 56100] [client 45.133.5.177:34981] [client 45.133.5.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/config.php"] [unique_id "afwToXdV4hYThdnhfxDbUAAAAIQ"]
[Thu May 07 12:22:57.494911 2026] [:error] [pid 56150:tid 56156] [client 45.133.5.179:51275] [client 45.133.5.179] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/chosen.php"] [unique_id "afwTodu4duXJJeTigXQ6wwAAAEQ"]
[Thu May 07 12:22:57.723653 2026] [:error] [pid 56065:tid 56116] [client 45.133.5.195:53485] [client 45.133.5.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "afwToXdV4hYThdnhfxDbUgAAAJQ"]
[Thu May 07 12:22:57.955599 2026] [:error] [pid 56065:tid 56114] [client 45.133.5.206:35689] [client 45.133.5.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/images/"] [unique_id "afwToXdV4hYThdnhfxDbUwAAAJI"]
[Thu May 07 12:22:58.178121 2026] [:error] [pid 56065:tid 56096] [client 45.133.5.173:20223] [client 45.133.5.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/dist/vendor/about.php"] [unique_id "afwTondV4hYThdnhfxDbVAAAAIA"]
[Thu May 07 12:22:58.389986 2026] [:error] [pid 56065:tid 56104] [client 45.133.5.191:32555] [client 45.133.5.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyfour/"] [unique_id "afwTondV4hYThdnhfxDbVQAAAIg"]
[Thu May 07 12:22:58.679780 2026] [:error] [pid 56066:tid 56136] [client 45.133.5.220:23369] [client 45.133.5.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-bindings/maint/"] [unique_id "afwTokYS8DGwDvklLv6y2QAAAM0"]
[Thu May 07 12:22:58.892254 2026] [:error] [pid 56150:tid 56161] [client 45.133.5.172:41983] [client 45.133.5.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/media/"] [unique_id "afwTotu4duXJJeTigXQ6yAAAAEk"]
[Thu May 07 12:22:59.103358 2026] [:error] [pid 56150:tid 56160] [client 45.133.5.214:26695] [client 45.133.5.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/customize-widgets/"] [unique_id "afwTo9u4duXJJeTigXQ6ywAAAEg"]
[Thu May 07 12:22:59.385342 2026] [:error] [pid 56065:tid 56108] [client 45.133.5.212:42641] [client 45.133.5.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/separator/"] [unique_id "afwTo3dV4hYThdnhfxDbVwAAAIw"]
[Thu May 07 12:22:59.598542 2026] [:error] [pid 56064:tid 56070] [client 45.133.5.208:26625] [client 45.133.5.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/imgareaselect/"] [unique_id "afwToysGkZZUEf_7QCMmewAAAAE"]
[Thu May 07 12:22:59.852968 2026] [:error] [pid 56065:tid 56112] [client 45.133.5.222:35625] [client 45.133.5.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afwTo3dV4hYThdnhfxDbWAAAAJA"]
[Thu May 07 12:23:00.088948 2026] [:error] [pid 56150:tid 56162] [client 45.133.5.173:54765] [client 45.133.5.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content.php"] [unique_id "afwTpNu4duXJJeTigXQ6zQAAAEo"]
[Thu May 07 12:23:00.303489 2026] [:error] [pid 56150:tid 56159] [client 45.133.5.193:47349] [client 45.133.5.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "afwTpNu4duXJJeTigXQ6zgAAAEc"]
[Thu May 07 12:23:00.634632 2026] [:error] [pid 56150:tid 56170] [client 45.133.5.180:39729] [client 45.133.5.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/.well-known/acme-challenge/"] [unique_id "afwTpNu4duXJJeTigXQ6zwAAAFI"]
[Thu May 07 12:23:00.853548 2026] [:error] [pid 56150:tid 56176] [client 45.133.5.171:42695] [client 45.133.5.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/shell.php"] [unique_id "afwTpNu4duXJJeTigXQ60QAAAFg"]
[Thu May 07 12:23:01.066702 2026] [:error] [pid 56150:tid 56166] [client 45.133.5.171:31125] [client 45.133.5.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/image/"] [unique_id "afwTpdu4duXJJeTigXQ60gAAAE4"]
[Thu May 07 12:23:01.285222 2026] [:error] [pid 56150:tid 56154] [client 45.133.5.183:46847] [client 45.133.5.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/files.php"] [unique_id "afwTpdu4duXJJeTigXQ60wAAAEI"]
[Thu May 07 12:23:01.570304 2026] [:error] [pid 1143:tid 1154] [client 45.133.5.197:52443] [client 45.133.5.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/video/"] [unique_id "afwTpZb7qeI8X5VYRr55YwAAAQk"]
[Thu May 07 12:23:01.783646 2026] [:error] [pid 1143:tid 1153] [client 45.133.5.167:29527] [client 45.133.5.167] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyfive/"] [unique_id "afwTpZb7qeI8X5VYRr55ZAAAAQg"]
[Thu May 07 12:23:02.013007 2026] [:error] [pid 56150:tid 56172] [client 45.133.5.229:42429] [client 45.133.5.229] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "afwTptu4duXJJeTigXQ61gAAAFQ"]
[Thu May 07 12:23:02.264337 2026] [:error] [pid 56150:tid 56174] [client 45.133.5.164:50785] [client 45.133.5.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-activate.php"] [unique_id "afwTptu4duXJJeTigXQ61wAAAFY"]
[Thu May 07 12:23:02.478143 2026] [:error] [pid 56066:tid 56124] [client 45.133.5.170:43621] [client 45.133.5.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/chosen.php"] [unique_id "afwTpkYS8DGwDvklLv6y3AAAAME"]
[Thu May 07 12:23:02.689723 2026] [:error] [pid 56150:tid 56163] [client 45.133.5.167:65529] [client 45.133.5.167] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/backup.php"] [unique_id "afwTptu4duXJJeTigXQ62QAAAEs"]
[Thu May 07 12:23:02.902793 2026] [:error] [pid 56150:tid 56169] [client 45.133.5.187:51467] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/"] [unique_id "afwTptu4duXJJeTigXQ62wAAAFE"]
[Thu May 07 12:23:03.117828 2026] [:error] [pid 56150:tid 56157] [client 45.133.5.203:39801] [client 45.133.5.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/login.php"] [unique_id "afwTp9u4duXJJeTigXQ63AAAAEU"]
[Thu May 07 12:23:03.352071 2026] [:error] [pid 56150:tid 56171] [client 45.133.5.224:32345] [client 45.133.5.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyfour/assets/"] [unique_id "afwTp9u4duXJJeTigXQ63QAAAFM"]
[Thu May 07 12:23:03.569864 2026] [:error] [pid 56064:tid 56071] [client 45.133.5.175:37575] [client 45.133.5.175] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ab.php"] [unique_id "afwTpysGkZZUEf_7QCMmfAAAAAI"]
[Thu May 07 12:23:03.794756 2026] [:error] [pid 56150:tid 56173] [client 45.133.5.193:26317] [client 45.133.5.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/login.php"] [unique_id "afwTp9u4duXJJeTigXQ63gAAAFU"]
[Thu May 07 12:23:04.056560 2026] [:error] [pid 1143:tid 1159] [client 45.133.5.208:23871] [client 45.133.5.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Auth/"] [unique_id "afwTqJb7qeI8X5VYRr55ZgAAAQ4"]
[Thu May 07 12:23:04.268255 2026] [:error] [pid 56065:tid 56110] [client 45.133.5.168:54681] [client 45.133.5.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/navigation/"] [unique_id "afwTqHdV4hYThdnhfxDbXQAAAI4"]
[Thu May 07 12:23:04.481657 2026] [:error] [pid 56066:tid 56130] [client 45.133.5.175:33413] [client 45.133.5.175] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/panel.php"] [unique_id "afwTqEYS8DGwDvklLv6y3gAAAMc"]
[Thu May 07 12:23:04.695082 2026] [:error] [pid 1143:tid 1168] [client 45.133.5.230:41899] [client 45.133.5.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/commands/"] [unique_id "afwTqJb7qeI8X5VYRr55ZwAAARc"]
[Thu May 07 12:23:04.909250 2026] [:error] [pid 56066:tid 56141] [client 45.133.5.222:25315] [client 45.133.5.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/vx.php"] [unique_id "afwTqEYS8DGwDvklLv6y3wAAANI"]
[Thu May 07 12:23:05.152935 2026] [:error] [pid 56066:tid 56123] [client 45.133.5.165:57117] [client 45.133.5.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/t.php"] [unique_id "afwTqUYS8DGwDvklLv6y4AAAAMA"]
[Thu May 07 12:23:05.365861 2026] [:error] [pid 56066:tid 56128] [client 45.133.5.182:30787] [client 45.133.5.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/about.php"] [unique_id "afwTqUYS8DGwDvklLv6y4QAAAMU"]
[Thu May 07 12:23:05.578874 2026] [:error] [pid 1143:tid 1145] [client 45.133.5.170:44725] [client 45.133.5.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/jcrop/"] [unique_id "afwTqZb7qeI8X5VYRr55agAAAQA"]
[Thu May 07 12:23:05.793757 2026] [:error] [pid 1143:tid 1151] [client 45.133.5.197:22289] [client 45.133.5.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/library/"] [unique_id "afwTqZb7qeI8X5VYRr55awAAAQY"]
[Thu May 07 12:23:06.008638 2026] [:error] [pid 1143:tid 1162] [client 45.133.5.207:48713] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/assets/fonts/"] [unique_id "afwTqpb7qeI8X5VYRr55bAAAARE"]
[Thu May 07 12:23:06.256365 2026] [:error] [pid 1143:tid 1167] [client 45.133.5.175:51423] [client 45.133.5.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/chosen.php"] [unique_id "afwTqpb7qeI8X5VYRr55bQAAARY"]
[Thu May 07 12:23:06.472859 2026] [:error] [pid 56066:tid 56140] [client 45.133.5.210:32519] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-signin.php"] [unique_id "afwTqkYS8DGwDvklLv6y4wAAANE"]
[Thu May 07 12:23:06.683323 2026] [:error] [pid 56066:tid 56147] [client 45.133.5.207:25093] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentynineteen/sass/site/"] [unique_id "afwTqkYS8DGwDvklLv6y5AAAANg"]
[Thu May 07 12:23:07.100721 2026] [:error] [pid 1143:tid 1154] [client 45.133.5.212:62393] [client 45.133.5.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-config-backup.php"] [unique_id "afwTq5b7qeI8X5VYRr55cAAAAQk"]
[Thu May 07 12:23:07.574630 2026] [:error] [pid 1143:tid 1153] [client 45.133.5.207:48835] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/coffee/"] [unique_id "afwTq5b7qeI8X5VYRr55cQAAAQg"]
[Thu May 07 12:23:08.089584 2026] [:error] [pid 56064:tid 56073] [client 45.133.5.170:43207] [client 45.133.5.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "afwTrCsGkZZUEf_7QCMmfgAAAAQ"]
[Thu May 07 12:23:08.393474 2026] [:error] [pid 56065:tid 56104] [client 45.133.5.214:61107] [client 45.133.5.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/html-api/widgets/"] [unique_id "afwTrHdV4hYThdnhfxDbXgAAAIg"]
[Thu May 07 12:23:08.753703 2026] [:error] [pid 56150:tid 56172] [client 45.133.5.178:35275] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/000.php"] [unique_id "afwTrNu4duXJJeTigXQ64AAAAFQ"]
[Thu May 07 12:23:08.964193 2026] [:error] [pid 56065:tid 56111] [client 45.133.5.192:43013] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/edit-wolf.php"] [unique_id "afwTrHdV4hYThdnhfxDbXwAAAI8"]
[Thu May 07 12:23:09.179616 2026] [:error] [pid 56066:tid 56139] [client 45.133.5.220:54929] [client 45.133.5.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "afwTrUYS8DGwDvklLv6y5QAAANA"]
[Thu May 07 12:23:09.396435 2026] [:error] [pid 56066:tid 56132] [client 45.133.5.210:43207] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/system.php"] [unique_id "afwTrUYS8DGwDvklLv6y5gAAAMk"]
[Thu May 07 12:23:09.607939 2026] [:error] [pid 56150:tid 56159] [client 45.133.5.228:55129] [client 45.133.5.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "afwTrdu4duXJJeTigXQ64wAAAEc"]
[Thu May 07 12:23:10.370874 2026] [:error] [pid 1143:tid 1158] [client 45.133.5.179:60957] [client 45.133.5.179] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/abcd.php"] [unique_id "afwTrpb7qeI8X5VYRr55cgAAAQ0"]
[Thu May 07 12:23:10.691737 2026] [:error] [pid 1143:tid 1155] [client 45.133.5.187:38391] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/adminfuns.php"] [unique_id "afwTrpb7qeI8X5VYRr55cwAAAQo"]
[Thu May 07 12:23:10.903723 2026] [:error] [pid 56150:tid 56155] [client 45.133.5.210:26101] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/app.php"] [unique_id "afwTrtu4duXJJeTigXQ65gAAAEM"]
[Thu May 07 12:23:11.164133 2026] [:error] [pid 1143:tid 1150] [client 45.133.5.167:27175] [client 45.133.5.167] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/files/"] [unique_id "afwTr5b7qeI8X5VYRr55dAAAAQU"]
[Thu May 07 12:23:11.379901 2026] [:error] [pid 56066:tid 56145] [client 45.133.5.207:48323] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/beteng83/ws78.php"] [unique_id "afwTr0YS8DGwDvklLv6y6AAAANY"]
[Thu May 07 12:23:11.595491 2026] [:error] [pid 56150:tid 56171] [client 45.133.5.180:60777] [client 45.133.5.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/template-singl-portfolio.php"] [unique_id "afwTr9u4duXJJeTigXQ65wAAAFM"]
[Thu May 07 12:23:11.808515 2026] [:error] [pid 56150:tid 56153] [client 45.133.5.195:53691] [client 45.133.5.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/chosen.php"] [unique_id "afwTr9u4duXJJeTigXQ66AAAAEE"]
[Thu May 07 12:23:12.055776 2026] [:error] [pid 56150:tid 56173] [client 45.133.5.178:52267] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ALFA_DATA/alfacgiapi/"] [unique_id "afwTsNu4duXJJeTigXQ66QAAAFU"]
[Thu May 07 12:23:12.267489 2026] [:error] [pid 1143:tid 1164] [client 45.133.5.165:48153] [client 45.133.5.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/comments-pagination-next/"] [unique_id "afwTsJb7qeI8X5VYRr55dQAAARM"]
[Thu May 07 12:23:12.480626 2026] [:error] [pid 1143:tid 1147] [client 45.133.5.188:31335] [client 45.133.5.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/html-api/"] [unique_id "afwTsJb7qeI8X5VYRr55dgAAAQI"]
[Thu May 07 12:23:12.694157 2026] [:error] [pid 56150:tid 56158] [client 45.133.5.228:31667] [client 45.133.5.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/class.php"] [unique_id "afwTsNu4duXJJeTigXQ66gAAAEY"]
[Thu May 07 12:23:12.909375 2026] [:error] [pid 56150:tid 56160] [client 45.133.5.207:52701] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/network/colors/"] [unique_id "afwTsNu4duXJJeTigXQ67AAAAEg"]
[Thu May 07 12:23:13.123526 2026] [:error] [pid 56150:tid 56156] [client 45.133.5.209:58301] [client 45.133.5.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/group/"] [unique_id "afwTsdu4duXJJeTigXQ67QAAAEQ"]
[Thu May 07 12:23:13.366410 2026] [:error] [pid 1143:tid 1167] [client 45.133.5.171:24735] [client 45.133.5.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "afwTsZb7qeI8X5VYRr55dwAAARY"]
[Thu May 07 12:23:13.577022 2026] [:error] [pid 1143:tid 1156] [client 45.133.5.203:51651] [client 45.133.5.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/module.php"] [unique_id "afwTsZb7qeI8X5VYRr55eAAAAQs"]
[Thu May 07 12:23:13.787572 2026] [:error] [pid 1143:tid 1161] [client 45.133.5.180:54341] [client 45.133.5.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/user.php"] [unique_id "afwTsZb7qeI8X5VYRr55eQAAARA"]
[Thu May 07 12:23:14.001001 2026] [:error] [pid 1143:tid 1148] [client 45.133.5.170:61585] [client 45.133.5.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/about.php"] [unique_id "afwTsZb7qeI8X5VYRr55egAAAQM"]
[Thu May 07 12:23:14.256748 2026] [:error] [pid 1143:tid 1149] [client 45.133.5.203:24711] [client 45.133.5.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/widget-group/"] [unique_id "afwTspb7qeI8X5VYRr55ewAAAQQ"]
[Thu May 07 12:23:14.467101 2026] [:error] [pid 1143:tid 1166] [client 45.133.5.185:44017] [client 45.133.5.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/config.php"] [unique_id "afwTspb7qeI8X5VYRr55fAAAARU"]
[Thu May 07 12:23:14.681869 2026] [:error] [pid 1143:tid 1169] [client 45.133.5.188:30221] [client 45.133.5.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/2025/"] [unique_id "afwTspb7qeI8X5VYRr55fQAAARg"]
[Thu May 07 12:23:14.894400 2026] [:error] [pid 1143:tid 1159] [client 45.133.5.195:53409] [client 45.133.5.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/install.php"] [unique_id "afwTspb7qeI8X5VYRr55fgAAAQ4"]
[Thu May 07 12:23:15.106809 2026] [:error] [pid 56150:tid 56174] [client 45.133.5.187:45775] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/post-content/"] [unique_id "afwTs9u4duXJJeTigXQ67wAAAFY"]
[Thu May 07 12:23:15.317949 2026] [:error] [pid 56064:tid 56091] [client 45.133.5.225:52201] [client 45.133.5.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/wp-blog.php"] [unique_id "afwTsysGkZZUEf_7QCMmfwAAABY"]
[Thu May 07 12:23:15.558316 2026] [:error] [pid 1143:tid 1168] [client 45.133.5.197:54783] [client 45.133.5.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/chosen.php"] [unique_id "afwTs5b7qeI8X5VYRr55fwAAARc"]
[Thu May 07 12:23:15.769870 2026] [:error] [pid 56065:tid 56118] [client 45.133.5.185:36139] [client 45.133.5.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "afwTs3dV4hYThdnhfxDbYgAAAJY"]
[Thu May 07 12:23:15.981516 2026] [:error] [pid 56064:tid 56072] [client 45.133.5.206:30103] [client 45.133.5.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/"] [unique_id "afwTsysGkZZUEf_7QCMmgQAAAAM"]
[Thu May 07 12:23:16.193812 2026] [:error] [pid 56150:tid 56162] [client 45.133.5.184:48119] [client 45.133.5.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "afwTtNu4duXJJeTigXQ68QAAAEo"]
[Thu May 07 12:23:16.410092 2026] [:error] [pid 56150:tid 56169] [client 45.133.5.187:34363] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/post-terms/"] [unique_id "afwTtNu4duXJJeTigXQ68gAAAFE"]
[Thu May 07 12:23:16.654942 2026] [:error] [pid 56150:tid 56152] [client 45.133.5.187:31541] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/we.php"] [unique_id "afwTtNu4duXJJeTigXQ68wAAAEA"]
[Thu May 07 12:23:16.866910 2026] [:error] [pid 56064:tid 56075] [client 45.133.5.189:43147] [client 45.133.5.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/legacy-widget/"] [unique_id "afwTtCsGkZZUEf_7QCMmgwAAAAY"]
[Thu May 07 12:23:17.080490 2026] [:error] [pid 56150:tid 56171] [client 45.133.5.206:50129] [client 45.133.5.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/lock360.php"] [unique_id "afwTtdu4duXJJeTigXQ69QAAAFM"]
[Thu May 07 12:23:17.293372 2026] [:error] [pid 56065:tid 56100] [client 45.133.5.214:52539] [client 45.133.5.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/"] [unique_id "afwTtXdV4hYThdnhfxDbYwAAAIQ"]
[Thu May 07 12:23:17.505127 2026] [:error] [pid 56150:tid 56175] [client 45.133.5.224:25139] [client 45.133.5.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/navigation-submenu/"] [unique_id "afwTtdu4duXJJeTigXQ69gAAAFc"]
[Thu May 07 12:23:17.753627 2026] [:error] [pid 56065:tid 56102] [client 45.133.5.216:39073] [client 45.133.5.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/file.php"] [unique_id "afwTtXdV4hYThdnhfxDbZAAAAIY"]
[Thu May 07 12:23:17.965576 2026] [:error] [pid 56065:tid 56109] [client 45.133.5.229:34435] [client 45.133.5.229] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/users.php"] [unique_id "afwTtXdV4hYThdnhfxDbZgAAAI0"]
[Thu May 07 12:23:18.177471 2026] [:error] [pid 56065:tid 56116] [client 45.133.5.194:38133] [client 45.133.5.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "afwTtndV4hYThdnhfxDbZwAAAJQ"]
[Thu May 07 12:23:18.390349 2026] [:error] [pid 56150:tid 56154] [client 45.133.5.169:49937] [client 45.133.5.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/library/222.php"] [unique_id "afwTttu4duXJJeTigXQ6-AAAAEI"]
[Thu May 07 12:23:18.600968 2026] [:error] [pid 56065:tid 56114] [client 45.133.5.207:36407] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-update.php"] [unique_id "afwTtndV4hYThdnhfxDbaAAAAJI"]
[Thu May 07 12:23:18.812091 2026] [:error] [pid 1143:tid 1164] [client 45.133.5.190:55665] [client 45.133.5.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/database.php"] [unique_id "afwTtpb7qeI8X5VYRr55gAAAARM"]
[Thu May 07 12:23:19.055533 2026] [:error] [pid 56064:tid 56076] [client 45.133.5.202:54147] [client 45.133.5.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/pomo/"] [unique_id "afwTtysGkZZUEf_7QCMmhgAAAAc"]
[Thu May 07 12:23:19.267747 2026] [:error] [pid 56064:tid 56070] [client 45.133.5.230:49457] [client 45.133.5.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/chosen.php"] [unique_id "afwTtysGkZZUEf_7QCMmhwAAAAE"]
[Thu May 07 12:23:19.479290 2026] [:error] [pid 56064:tid 56090] [client 45.133.5.180:56113] [client 45.133.5.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/network/"] [unique_id "afwTtysGkZZUEf_7QCMmiAAAABU"]
[Thu May 07 12:23:19.698395 2026] [:error] [pid 1143:tid 1147] [client 45.133.5.162:64531] [client 45.133.5.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/widgets/"] [unique_id "afwTt5b7qeI8X5VYRr55gQAAAQI"]
[Thu May 07 12:23:19.908941 2026] [:error] [pid 1143:tid 1152] [client 45.133.5.188:40417] [client 45.133.5.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/"] [unique_id "afwTt5b7qeI8X5VYRr55ggAAAQc"]
[Thu May 07 12:23:20.172424 2026] [:error] [pid 1143:tid 1160] [client 45.133.5.187:49373] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/"] [unique_id "afwTuJb7qeI8X5VYRr55gwAAAQ8"]
[Thu May 07 12:23:20.383800 2026] [:error] [pid 56064:tid 56085] [client 45.133.5.191:24477] [client 45.133.5.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/woocommerce/includes/import/about.php"] [unique_id "afwTuCsGkZZUEf_7QCMmigAAABA"]
[Thu May 07 12:23:20.595494 2026] [:error] [pid 56064:tid 56088] [client 45.133.5.184:20801] [client 45.133.5.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/paragraph/"] [unique_id "afwTuCsGkZZUEf_7QCMmjAAAABM"]
[Thu May 07 12:23:20.805991 2026] [:error] [pid 56066:tid 56141] [client 45.133.5.168:47835] [client 45.133.5.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/query-pagination/"] [unique_id "afwTuEYS8DGwDvklLv6y6gAAANI"]
[Thu May 07 12:23:21.058284 2026] [:error] [pid 56065:tid 56107] [client 45.133.5.183:29015] [client 45.133.5.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "afwTuXdV4hYThdnhfxDbawAAAIs"]
[Thu May 07 12:23:21.272043 2026] [:error] [pid 56064:tid 56091] [client 45.133.5.206:31617] [client 45.133.5.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/mediaelement/"] [unique_id "afwTuSsGkZZUEf_7QCMmjQAAABY"]
[Thu May 07 12:23:21.482842 2026] [:error] [pid 56064:tid 56072] [client 45.133.5.193:21319] [client 45.133.5.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentythree/"] [unique_id "afwTuSsGkZZUEf_7QCMmjgAAAAM"]
[Thu May 07 12:23:21.693696 2026] [:error] [pid 56064:tid 56075] [client 45.133.5.162:29743] [client 45.133.5.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/astra/assets/css/"] [unique_id "afwTuSsGkZZUEf_7QCMmkAAAAAY"]
[Thu May 07 12:23:21.906660 2026] [:error] [pid 1143:tid 1161] [client 45.133.5.184:49925] [client 45.133.5.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/222.php"] [unique_id "afwTuZb7qeI8X5VYRr55hQAAARA"]
[Thu May 07 12:23:22.117973 2026] [:error] [pid 56065:tid 56105] [client 45.133.5.200:44193] [client 45.133.5.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/"] [unique_id "afwTundV4hYThdnhfxDbbgAAAIk"]
[Thu May 07 12:23:22.356090 2026] [:error] [pid 1143:tid 1153] [client 45.133.5.219:26087] [client 45.133.5.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyfour/patterns/template-singl-portfolio.php"] [unique_id "afwTupb7qeI8X5VYRr55hwAAAQg"]
[Thu May 07 12:23:22.568387 2026] [:error] [pid 56150:tid 56167] [client 45.133.5.191:33025] [client 45.133.5.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "afwTutu4duXJJeTigXQ6-wAAAE8"]
[Thu May 07 12:23:22.781595 2026] [:error] [pid 56150:tid 56172] [client 45.133.5.195:49065] [client 45.133.5.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/widgets/wp-conflg.php"] [unique_id "afwTutu4duXJJeTigXQ6_AAAAFQ"]
[Thu May 07 12:23:22.994312 2026] [:error] [pid 56150:tid 56164] [client 45.133.5.182:41373] [client 45.133.5.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Exception/"] [unique_id "afwTutu4duXJJeTigXQ6_QAAAEw"]
[Thu May 07 12:23:23.207485 2026] [:error] [pid 56150:tid 56162] [client 45.133.5.170:43937] [client 45.133.5.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/pattern/"] [unique_id "afwTu9u4duXJJeTigXQ6_gAAAEo"]
[Thu May 07 12:23:23.454560 2026] [:error] [pid 1143:tid 1163] [client 45.133.5.164:31063] [client 45.133.5.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wp-load.php"] [unique_id "afwTu5b7qeI8X5VYRr55iQAAARI"]
[Thu May 07 12:23:23.665333 2026] [:error] [pid 56066:tid 56131] [client 45.133.5.219:61823] [client 45.133.5.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/news-portal/user-install.php"] [unique_id "afwTu0YS8DGwDvklLv6y6wAAAMg"]
[Thu May 07 12:23:23.880031 2026] [:error] [pid 56065:tid 56118] [client 45.133.5.229:35771] [client 45.133.5.229] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/table/"] [unique_id "afwTu3dV4hYThdnhfxDbcQAAAJY"]
[Thu May 07 12:23:24.091549 2026] [:error] [pid 56064:tid 56090] [client 45.133.5.216:41541] [client 45.133.5.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/block-bindings/"] [unique_id "afwTvCsGkZZUEf_7QCMmkwAAABU"]
[Thu May 07 12:23:24.304812 2026] [:error] [pid 56065:tid 56102] [client 45.133.5.208:48551] [client 45.133.5.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wp-cache-sys/"] [unique_id "afwTvHdV4hYThdnhfxDbcgAAAIY"]
[Thu May 07 12:23:24.553113 2026] [:error] [pid 56150:tid 56163] [client 45.133.5.175:52095] [client 45.133.5.175] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/dist"] [unique_id "afwTvNu4duXJJeTigXQ7AAAAAEs"]
[Thu May 07 12:23:24.776531 2026] [:error] [pid 56150:tid 56157] [client 45.133.5.196:22555] [client 45.133.5.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/comments-less.php"] [unique_id "afwTvNu4duXJJeTigXQ7AgAAAEU"]
[Thu May 07 12:23:24.988095 2026] [:error] [pid 56065:tid 56116] [client 45.133.5.170:55467] [client 45.133.5.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh.php"] [unique_id "afwTvHdV4hYThdnhfxDbdQAAAJQ"]
[Thu May 07 12:23:25.200527 2026] [:error] [pid 56064:tid 56069] [client 45.133.5.230:35091] [client 45.133.5.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/accordion/"] [unique_id "afwTvSsGkZZUEf_7QCMmlAAAAAA"]
[Thu May 07 12:23:25.414415 2026] [:error] [pid 56065:tid 56103] [client 45.133.5.171:61857] [client 45.133.5.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/Nxploited/class-payment.php"] [unique_id "afwTvXdV4hYThdnhfxDbdwAAAIc"]
[Thu May 07 12:23:25.654009 2026] [:error] [pid 56066:tid 56129] [client 45.133.5.207:30907] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/home.php"] [unique_id "afwTvUYS8DGwDvklLv6y8QAAAMY"]
[Thu May 07 12:23:25.865550 2026] [:error] [pid 56066:tid 56125] [client 45.133.5.216:53695] [client 45.133.5.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/fonts/"] [unique_id "afwTvUYS8DGwDvklLv6y8gAAAMI"]
[Thu May 07 12:23:26.079059 2026] [:error] [pid 56066:tid 56137] [client 45.133.5.200:37357] [client 45.133.5.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/namespaced/Core/"] [unique_id "afwTvkYS8DGwDvklLv6y8wAAAM4"]
[Thu May 07 12:23:26.300717 2026] [:error] [pid 56066:tid 56145] [client 45.133.5.181:27829] [client 45.133.5.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/file/"] [unique_id "afwTvkYS8DGwDvklLv6y9AAAANY"]
[Thu May 07 12:23:26.512101 2026] [:error] [pid 56064:tid 56088] [client 45.133.5.194:40643] [client 45.133.5.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-theme-json-resolver-sql.php"] [unique_id "afwTvisGkZZUEf_7QCMmlwAAABM"]
[Thu May 07 12:23:26.756216 2026] [:error] [pid 56150:tid 56167] [client 45.133.5.167:40587] [client 45.133.5.167] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "afwTvtu4duXJJeTigXQ7CQAAAE8"]
[Thu May 07 12:23:26.973653 2026] [:error] [pid 56066:tid 56131] [client 45.133.5.189:54857] [client 45.133.5.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/widgets/"] [unique_id "afwTvkYS8DGwDvklLv6y_AAAAMg"]
[Thu May 07 12:23:27.189756 2026] [:error] [pid 56150:tid 56152] [client 45.133.5.190:64339] [client 45.133.5.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/interactivity-api/"] [unique_id "afwTv9u4duXJJeTigXQ7EgAAAEA"]
[Thu May 07 12:23:27.403167 2026] [:error] [pid 1143:tid 1162] [client 45.133.5.225:27745] [client 45.133.5.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/taxonomy-compiler.php"] [unique_id "afwTv5b7qeI8X5VYRr55kgAAARE"]
[Thu May 07 12:23:27.651736 2026] [:error] [pid 56065:tid 56110] [client 45.133.5.180:51037] [client 45.133.5.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/smilies/"] [unique_id "afwTv3dV4hYThdnhfxDbiQAAAI4"]
[Thu May 07 12:23:27.867697 2026] [:error] [pid 56065:tid 56098] [client 45.133.5.179:61959] [client 45.133.5.179] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyone/assets/"] [unique_id "afwTv3dV4hYThdnhfxDbigAAAII"]
[Thu May 07 12:23:28.079831 2026] [:error] [pid 56065:tid 56120] [client 45.133.5.195:26889] [client 45.133.5.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/aboutc.php"] [unique_id "afwTwHdV4hYThdnhfxDbiwAAAJg"]
[Thu May 07 12:23:28.293348 2026] [:error] [pid 56065:tid 56118] [client 45.133.5.162:21505] [client 45.133.5.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/chosen.php"] [unique_id "afwTwHdV4hYThdnhfxDbjAAAAJY"]
[Thu May 07 12:23:28.503980 2026] [:error] [pid 56064:tid 56090] [client 45.133.5.192:48637] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/Content/Type/Sniffer.plugin.php"] [unique_id "afwTwCsGkZZUEf_7QCMmogAAABU"]
[Thu May 07 12:23:28.715513 2026] [:error] [pid 1143:tid 1164] [client 45.133.5.206:52043] [client 45.133.5.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "afwTwJb7qeI8X5VYRr55nQAAARM"]
[Thu May 07 12:23:28.963607 2026] [:error] [pid 1143:tid 1152] [client 45.133.5.183:48871] [client 45.133.5.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cgi-bin/cgi-bin/config.php"] [unique_id "afwTwJb7qeI8X5VYRr55nwAAAQc"]
[Thu May 07 12:23:29.175680 2026] [:error] [pid 56150:tid 56160] [client 45.133.5.180:22011] [client 45.133.5.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/blue/nbpmo.php"] [unique_id "afwTwdu4duXJJeTigXQ7IAAAAEg"]
[Thu May 07 12:23:29.386565 2026] [:error] [pid 56064:tid 56073] [client 45.133.5.164:31355] [client 45.133.5.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/system.php"] [unique_id "afwTwSsGkZZUEf_7QCMmpgAAAAQ"]
[Thu May 07 12:23:29.597428 2026] [:error] [pid 56150:tid 56175] [client 45.133.5.212:63801] [client 45.133.5.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/login.php"] [unique_id "afwTwdu4duXJJeTigXQ7KAAAAFc"]
[Thu May 07 12:23:29.808253 2026] [:error] [pid 56064:tid 56083] [client 45.133.5.167:50645] [client 45.133.5.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sc_1.php"] [unique_id "afwTwSsGkZZUEf_7QCMmqQAAAA4"]
[Thu May 07 12:23:30.056352 2026] [:error] [pid 56150:tid 56170] [client 45.133.5.192:22281] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/gk.php"] [unique_id "afwTwtu4duXJJeTigXQ7LAAAAFI"]
[Thu May 07 12:23:30.267517 2026] [:error] [pid 56065:tid 56120] [client 45.133.5.192:37411] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/about/system_core.php"] [unique_id "afwTwndV4hYThdnhfxDbnQAAAJg"]
[Thu May 07 12:23:30.500421 2026] [:error] [pid 56150:tid 56163] [client 45.133.5.179:43185] [client 45.133.5.179] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ALFA_DATA/system_core.php"] [unique_id "afwTwtu4duXJJeTigXQ7LwAAAEs"]
[Thu May 07 12:23:30.736604 2026] [:error] [pid 56066:tid 56132] [client 45.133.5.225:41005] [client 45.133.5.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ALFA_DATA/alfacgiapi/system_core.php"] [unique_id "afwTwkYS8DGwDvklLv6zHQAAAMk"]
[Thu May 07 12:23:31.203420 2026] [:error] [pid 56150:tid 56164] [client 45.133.5.183:59331] [client 45.133.5.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/contact/system_core.php"] [unique_id "afwTw9u4duXJJeTigXQ7OQAAAEw"]
[Thu May 07 12:23:31.415005 2026] [:error] [pid 56150:tid 56165] [client 45.133.5.200:36335] [client 45.133.5.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/ai-builder/system_core.php"] [unique_id "afwTw9u4duXJJeTigXQ7OwAAAE0"]
[Thu May 07 12:23:31.656926 2026] [:error] [pid 56065:tid 56104] [client 45.133.5.230:49177] [client 45.133.5.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/ast-block-templates-json/system_core.php"] [unique_id "afwTw3dV4hYThdnhfxDbqAAAAIg"]
[Thu May 07 12:23:31.868754 2026] [:error] [pid 56064:tid 56078] [client 45.133.5.180:63573] [client 45.133.5.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/astra-sites/json/system_core.php"] [unique_id "afwTwysGkZZUEf_7QCMmrgAAAAk"]
[Thu May 07 12:23:32.080591 2026] [:error] [pid 56150:tid 56175] [client 45.133.5.224:54959] [client 45.133.5.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/cartflows-logs/system_core.php"] [unique_id "afwTxNu4duXJJeTigXQ7PQAAAFc"]
[Thu May 07 12:23:32.292918 2026] [:error] [pid 56064:tid 56087] [client 45.133.5.208:43247] [client 45.133.5.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/edd/system_core.php"] [unique_id "afwTxCsGkZZUEf_7QCMmrwAAABI"]
[Thu May 07 12:23:32.506100 2026] [:error] [pid 56150:tid 56166] [client 45.133.5.177:23307] [client 45.133.5.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/elementor/system_core.php"] [unique_id "afwTxNu4duXJJeTigXQ7QQAAAE4"]
[Thu May 07 12:23:32.758463 2026] [:error] [pid 56064:tid 56071] [client 45.133.5.230:57153] [client 45.133.5.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/simply-static/temp-files/system_core.php"] [unique_id "afwTxCsGkZZUEf_7QCMmsgAAAAI"]
[Thu May 07 12:23:32.970699 2026] [:error] [pid 56150:tid 56173] [client 45.133.5.191:25503] [client 45.133.5.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/st-importer/system_core.php"] [unique_id "afwTxNu4duXJJeTigXQ7RQAAAFU"]
[Thu May 07 12:23:33.180339 2026] [:error] [pid 56066:tid 56142] [client 45.133.5.197:28261] [client 45.133.5.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/system_core.php"] [unique_id "afwTxUYS8DGwDvklLv6zHgAAANM"]
[Thu May 07 12:23:33.392783 2026] [:error] [pid 56065:tid 56098] [client 45.133.5.169:61909] [client 45.133.5.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wc-logs/system_core.php"] [unique_id "afwTxXdV4hYThdnhfxDbsQAAAII"]
[Thu May 07 12:23:33.608088 2026] [:error] [pid 1143:tid 1167] [client 45.133.5.165:63549] [client 45.133.5.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/woocommerce_uploads/system_core.php"] [unique_id "afwTxZb7qeI8X5VYRr55qwAAARY"]
[Thu May 07 12:23:33.821591 2026] [:error] [pid 1143:tid 1154] [client 45.133.5.171:61459] [client 45.133.5.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wpforms/cache/system_core.php"] [unique_id "afwTxZb7qeI8X5VYRr55rAAAAQk"]
[Thu May 07 12:23:34.055341 2026] [:error] [pid 1143:tid 1149] [client 45.133.5.184:59663] [client 45.133.5.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-file-manager-pro/"] [unique_id "afwTxpb7qeI8X5VYRr55rQAAAQQ"]
[Thu May 07 12:23:34.266380 2026] [:error] [pid 56065:tid 56105] [client 45.133.5.228:61877] [client 45.133.5.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/db-status.php"] [unique_id "afwTxndV4hYThdnhfxDbtgAAAIk"]
[Thu May 07 12:23:34.481475 2026] [:error] [pid 1143:tid 1146] [client 45.133.5.187:43197] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-content/uploads/"] [unique_id "afwTxpb7qeI8X5VYRr55rgAAAQE"]
[Thu May 07 12:23:34.695292 2026] [:error] [pid 1143:tid 1161] [client 45.133.5.230:32963] [client 45.133.5.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/elementor/css/"] [unique_id "afwTxpb7qeI8X5VYRr55sAAAARA"]
[Thu May 07 12:23:34.909438 2026] [:error] [pid 56066:tid 56139] [client 45.133.5.193:45185] [client 45.133.5.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-file-manager-pro/fm_backup/"] [unique_id "afwTxkYS8DGwDvklLv6zIQAAANA"]
[Thu May 07 12:23:35.155020 2026] [:error] [pid 1143:tid 1169] [client 45.133.5.225:43491] [client 45.133.5.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/well-known/"] [unique_id "afwTx5b7qeI8X5VYRr55sQAAARg"]
[Thu May 07 12:23:35.369373 2026] [:error] [pid 1143:tid 1151] [client 45.133.5.230:59099] [client 45.133.5.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/well-known/pki-validation/"] [unique_id "afwTx5b7qeI8X5VYRr55sgAAAQY"]
[Thu May 07 12:23:35.581943 2026] [:error] [pid 1143:tid 1147] [client 45.133.5.178:43185] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/system.php"] [unique_id "afwTx5b7qeI8X5VYRr55swAAAQI"]
[Thu May 07 12:23:35.794988 2026] [:error] [pid 56150:tid 56161] [client 45.133.5.200:24151] [client 45.133.5.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/panel.php"] [unique_id "afwTx9u4duXJJeTigXQ7TgAAAEk"]
[Thu May 07 12:23:36.006553 2026] [:error] [pid 56066:tid 56133] [client 45.133.5.191:64663] [client 45.133.5.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/home.php"] [unique_id "afwTyEYS8DGwDvklLv6zIwAAAMo"]
[Thu May 07 12:23:37.251491 2026] [:error] [pid 1143:tid 1147] [client 45.133.5.181:46587] [client 45.133.5.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp.php"] [unique_id "afwTyZb7qeI8X5VYRr55ywAAAQI"]
[Thu May 07 12:23:37.465620 2026] [:error] [pid 56150:tid 56176] [client 45.133.5.167:25953] [client 45.133.5.167] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/login.php"] [unique_id "afwTydu4duXJJeTigXQ7UAAAAFg"]
[Thu May 07 12:23:37.681965 2026] [:error] [pid 56150:tid 56175] [client 45.133.5.190:35455] [client 45.133.5.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/media/system_core.php"] [unique_id "afwTydu4duXJJeTigXQ7UQAAAFc"]
[Thu May 07 12:23:37.896773 2026] [:error] [pid 56150:tid 56162] [client 45.133.5.162:28385] [client 45.133.5.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/system_core.php"] [unique_id "afwTydu4duXJJeTigXQ7VQAAAEo"]
[Thu May 07 12:23:38.107971 2026] [:error] [pid 56150:tid 56156] [client 45.133.5.208:51091] [client 45.133.5.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/system_core.php"] [unique_id "afwTytu4duXJJeTigXQ7VgAAAEQ"]
[Thu May 07 12:23:38.374382 2026] [:error] [pid 1143:tid 1167] [client 45.133.5.187:48793] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/system_core.php"] [unique_id "afwTypb7qeI8X5VYRr552wAAARY"]
[Thu May 07 12:23:38.584320 2026] [:error] [pid 1143:tid 1145] [client 45.133.5.171:25733] [client 45.133.5.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-json/oembed/system_core.php"] [unique_id "afwTypb7qeI8X5VYRr554AAAAQA"]
[Thu May 07 12:23:38.796118 2026] [:error] [pid 1143:tid 1149] [client 45.133.5.229:49231] [client 45.133.5.229] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-json/system_core.php"] [unique_id "afwTypb7qeI8X5VYRr555AAAAQQ"]
[Thu May 07 12:23:39.008516 2026] [:error] [pid 1143:tid 1160] [client 45.133.5.191:64201] [client 45.133.5.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/system_core.php"] [unique_id "afwTy5b7qeI8X5VYRr556AAAAQ8"]
[Thu May 07 12:23:39.257483 2026] [:error] [pid 56064:tid 56073] [client 45.133.5.221:43949] [client 45.133.5.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/system_core.php"] [unique_id "afwTyysGkZZUEf_7QCMmyAAAAAQ"]
[Thu May 07 12:23:39.485165 2026] [:error] [pid 56150:tid 56159] [client 45.133.5.162:49227] [client 45.133.5.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-content/wp-config-backup.php"] [unique_id "afwTy9u4duXJJeTigXQ7WgAAAEc"]
[Thu May 07 12:23:39.697985 2026] [:error] [pid 56065:tid 56106] [client 45.133.5.188:51945] [client 45.133.5.188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-config.php"] [unique_id "afwTy3dV4hYThdnhfxDbwgAAAIo"]
[Thu May 07 12:23:39.910783 2026] [:error] [pid 1143:tid 1159] [client 45.133.5.206:22877] [client 45.133.5.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/js_composer/bak.php"] [unique_id "afwTy5b7qeI8X5VYRr557AAAAQ4"]
[Thu May 07 12:23:40.168483 2026] [:error] [pid 56150:tid 56155] [client 45.133.5.219:38607] [client 45.133.5.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/elementor/assets/css/conditionals/system_core.php"] [unique_id "afwTzNu4duXJJeTigXQ7XAAAAEM"]
[Thu May 07 12:23:40.397893 2026] [:error] [pid 56066:tid 56141] [client 45.133.5.191:55123] [client 45.133.5.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/system_core.php"] [unique_id "afwTzEYS8DGwDvklLv6zKQAAANI"]
[Thu May 07 12:23:40.608953 2026] [:error] [pid 56066:tid 56130] [client 45.133.5.188:63121] [client 45.133.5.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wpforms-lite/assets/css/frontend/modern/system_core.php"] [unique_id "afwTzEYS8DGwDvklLv6zKgAAAMc"]
[Thu May 07 12:23:40.852179 2026] [:error] [pid 1143:tid 1155] [client 45.133.5.197:32267] [client 45.133.5.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-content/plugins/wp-config-backup.php"] [unique_id "afwTzJb7qeI8X5VYRr557QAAAQo"]
[Thu May 07 12:23:41.064130 2026] [:error] [pid 56150:tid 56152] [client 45.133.5.202:58815] [client 45.133.5.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wp-config-backup.php"] [unique_id "afwTzdu4duXJJeTigXQ7XgAAAEA"]
[Thu May 07 12:23:41.287008 2026] [:error] [pid 1143:tid 1161] [client 45.133.5.169:53445] [client 45.133.5.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/cielhpn/"] [unique_id "afwTzZb7qeI8X5VYRr557gAAARA"]
[Thu May 07 12:23:41.554551 2026] [:error] [pid 1143:tid 1150] [client 45.133.5.225:35751] [client 45.133.5.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/elementor-pro/modules/loop-filter/data/endpoints/about.php"] [unique_id "afwTzZb7qeI8X5VYRr557wAAAQU"]
[Thu May 07 12:23:41.768183 2026] [:error] [pid 56064:tid 56093] [client 45.133.5.165:52709] [client 45.133.5.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/forminator/library/field-autofill-providers/contracts/wp-login.php"] [unique_id "afwTzSsGkZZUEf_7QCMmzAAAABg"]
[Thu May 07 12:23:41.980104 2026] [:error] [pid 1143:tid 1158] [client 45.133.5.194:60993] [client 45.133.5.194] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/advanced-custom-fields-pro/includes/Updater/about.php"] [unique_id "afwTzZb7qeI8X5VYRr558AAAAQ0"]
[Thu May 07 12:23:42.199754 2026] [:error] [pid 56150:tid 56154] [client 45.133.5.188:60709] [client 45.133.5.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/class-wp-logo.php"] [unique_id "afwTztu4duXJJeTigXQ7YAAAAEI"]
[Thu May 07 12:23:42.459791 2026] [:error] [pid 56066:tid 56139] [client 45.133.5.168:34355] [client 45.133.5.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/js_composer/include/classes/vendors/plugins/test.php"] [unique_id "afwTzkYS8DGwDvklLv6zKwAAANA"]
[Thu May 07 12:23:42.674669 2026] [:error] [pid 56065:tid 56101] [client 45.133.5.178:27485] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/revslider/admin/assets/js/plugins/maintenance.php"] [unique_id "afwTzndV4hYThdnhfxDbwwAAAIU"]
[Thu May 07 12:23:42.886403 2026] [:error] [pid 56150:tid 56156] [client 45.133.5.200:41889] [client 45.133.5.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/contact-form-7/includes/js/jquery-ui/themes/wp-mail.php"] [unique_id "afwTztu4duXJJeTigXQ7YgAAAEQ"]
[Thu May 07 12:23:43.098592 2026] [:error] [pid 56066:tid 56133] [client 45.133.5.192:44567] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/sitepress-multilingual-cms/classes/plugins/wp-blog-header.php"] [unique_id "afwTz0YS8DGwDvklLv6zLAAAAMo"]
[Thu May 07 12:23:43.310115 2026] [:error] [pid 56064:tid 56080] [client 45.133.5.207:39655] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/updraftplus/includes/jstree/themes/wp-activate.php"] [unique_id "afwTzysGkZZUEf_7QCMmzQAAAAs"]
[Thu May 07 12:23:43.555668 2026] [:error] [pid 56150:tid 56173] [client 45.133.5.185:61997] [client 45.133.5.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wp-file-manager/lib/themes/options.php"] [unique_id "afwTz9u4duXJJeTigXQ7YwAAAFU"]
[Thu May 07 12:23:43.766160 2026] [:error] [pid 56066:tid 56145] [client 45.133.5.206:42561] [client 45.133.5.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wp-blog-header.php"] [unique_id "afwTz0YS8DGwDvklLv6zLQAAANY"]
[Thu May 07 12:23:43.977452 2026] [:error] [pid 56064:tid 56072] [client 45.133.5.179:49091] [client 45.133.5.179] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/elementor/assets/lib/pickr/themes/wp-blog-header.php"] [unique_id "afwTzysGkZZUEf_7QCMmzgAAAAM"]
[Thu May 07 12:23:44.188790 2026] [:error] [pid 56066:tid 56126] [client 45.133.5.170:40989] [client 45.133.5.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/contact-form-7/uoyaugar.php"] [unique_id "afwT0EYS8DGwDvklLv6zLgAAAMM"]
[Thu May 07 12:23:44.401348 2026] [:error] [pid 56065:tid 56116] [client 45.133.5.216:31629] [client 45.133.5.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/check-email/config.php"] [unique_id "afwT0HdV4hYThdnhfxDbxQAAAJQ"]
[Thu May 07 12:23:44.612706 2026] [:error] [pid 56064:tid 56070] [client 45.133.5.209:55315] [client 45.133.5.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/file-manager-advanced/config.php"] [unique_id "afwT0CsGkZZUEf_7QCMm0AAAAAE"]
[Thu May 07 12:23:44.857894 2026] [:error] [pid 56065:tid 56098] [client 45.133.5.214:48903] [client 45.133.5.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "afwT0HdV4hYThdnhfxDbxgAAAII"]
[Thu May 07 12:23:45.075379 2026] [:error] [pid 56064:tid 56076] [client 45.133.5.229:53419] [client 45.133.5.229] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/elementor/lndex.php"] [unique_id "afwT0SsGkZZUEf_7QCMm0gAAAAc"]
[Thu May 07 12:23:45.288618 2026] [:error] [pid 56150:tid 56159] [client 45.133.5.189:59563] [client 45.133.5.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wordpress-seo/wp-seo-trigger-table.php"] [unique_id "afwT0du4duXJJeTigXQ7ZAAAAEc"]
[Thu May 07 12:23:45.608385 2026] [:error] [pid 56066:tid 56134] [client 45.133.5.222:51491] [client 45.133.5.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-content/plugins/admin.php"] [unique_id "afwT0UYS8DGwDvklLv6zLwAAAMs"]
[Thu May 07 12:23:45.986150 2026] [:error] [pid 1143:tid 1153] [client 45.133.5.222:37111] [client 45.133.5.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/star-addons-for-elementor/includes/class-star-addons-uploads.php"] [unique_id "afwT0Zb7qeI8X5VYRr558gAAAQg"]
[Thu May 07 12:23:46.372155 2026] [:error] [pid 56064:tid 56079] [client 45.133.5.188:35905] [client 45.133.5.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/contact-form-7-honeypot/includes/rest-api/wp-admin/config.php"] [unique_id "afwT0isGkZZUEf_7QCMm1AAAAAo"]
[Thu May 07 12:23:46.583452 2026] [:error] [pid 56065:tid 56115] [client 45.133.5.224:44751] [client 45.133.5.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/js_composer/include/classes/vendors/plugins/panel.php"] [unique_id "afwT0ndV4hYThdnhfxDbyAAAAJM"]
[Thu May 07 12:23:46.795273 2026] [:error] [pid 1143:tid 1147] [client 45.133.5.192:50821] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/the-events-calendar/build/css/integrations/plugins/options.php"] [unique_id "afwT0pb7qeI8X5VYRr559AAAAQI"]
[Thu May 07 12:23:47.005346 2026] [:error] [pid 56150:tid 56157] [client 45.133.5.200:29951] [client 45.133.5.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/updraftplus/includes/jstree/themes/config.php"] [unique_id "afwT09u4duXJJeTigXQ7ZQAAAEU"]
[Thu May 07 12:23:47.216080 2026] [:error] [pid 1143:tid 1157] [client 45.133.5.224:26327] [client 45.133.5.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/ssss/src.php"] [unique_id "afwT05b7qeI8X5VYRr559QAAAQw"]
[Thu May 07 12:23:47.427255 2026] [:error] [pid 1143:tid 1163] [client 45.133.5.183:51657] [client 45.133.5.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/maintenance.php"] [unique_id "afwT05b7qeI8X5VYRr559gAAARI"]
[Thu May 07 12:23:47.658359 2026] [:error] [pid 56150:tid 56155] [client 45.133.5.173:34119] [client 45.133.5.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/tiktok-for-business/"] [unique_id "afwT09u4duXJJeTigXQ7ZgAAAEM"]
[Thu May 07 12:23:47.868909 2026] [:error] [pid 56150:tid 56171] [client 45.133.5.194:22525] [client 45.133.5.194] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/contact-form-7/base-theme.php"] [unique_id "afwT09u4duXJJeTigXQ7ZwAAAFM"]
[Thu May 07 12:23:48.080340 2026] [:error] [pid 56065:tid 56099] [client 45.133.5.219:41777] [client 45.133.5.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hello-plus/classes/ehp-bes.php"] [unique_id "afwT1HdV4hYThdnhfxDbywAAAIM"]
[Thu May 07 12:23:48.296078 2026] [:error] [pid 56150:tid 56166] [client 45.133.5.209:26999] [client 45.133.5.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/mu-plugins/config.php"] [unique_id "afwT1Nu4duXJJeTigXQ7aQAAAE4"]
[Thu May 07 12:23:48.508912 2026] [:error] [pid 56150:tid 56170] [client 45.133.5.206:56055] [client 45.133.5.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-load.php"] [unique_id "afwT1Nu4duXJJeTigXQ7agAAAFI"]
[Thu May 07 12:23:48.753948 2026] [:error] [pid 1143:tid 1161] [client 45.133.5.219:37127] [client 45.133.5.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/site-logo/about.php"] [unique_id "afwT1Jb7qeI8X5VYRr55-QAAARA"]
[Thu May 07 12:23:48.966125 2026] [:error] [pid 1143:tid 1150] [client 45.133.5.208:55687] [client 45.133.5.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/newfold-page-cachesocial/about.php"] [unique_id "afwT1Jb7qeI8X5VYRr55-gAAAQU"]
[Thu May 07 12:23:49.178045 2026] [:error] [pid 56150:tid 56173] [client 45.133.5.192:43695] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/file61.php"] [unique_id "afwT1du4duXJJeTigXQ7bAAAAFU"]
[Thu May 07 12:23:49.391618 2026] [:error] [pid 1143:tid 1158] [client 45.133.5.189:49085] [client 45.133.5.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/comment-author-name/editers.php"] [unique_id "afwT1Zb7qeI8X5VYRr55-wAAAQ0"]
[Thu May 07 12:23:49.600433 2026] [:error] [pid 56150:tid 56172] [client 45.133.5.200:50473] [client 45.133.5.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/plugin-editor-trigger.php"] [unique_id "afwT1du4duXJJeTigXQ7bQAAAFQ"]
[Thu May 07 12:23:49.857644 2026] [:error] [pid 56150:tid 56165] [client 45.133.5.192:34393] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/query-pagination-numbers/wp-cron.php"] [unique_id "afwT1du4duXJJeTigXQ7bwAAAE0"]
[Thu May 07 12:23:50.068589 2026] [:error] [pid 56064:tid 56073] [client 45.133.5.183:62209] [client 45.133.5.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "afwT1isGkZZUEf_7QCMm1gAAAAQ"]
[Thu May 07 12:23:50.282303 2026] [:error] [pid 56064:tid 56081] [client 45.133.5.195:32687] [client 45.133.5.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade-temp-backup/media/files/files/cache/ulnc/wbdo/"] [unique_id "afwT1isGkZZUEf_7QCMm1wAAAAw"]
[Thu May 07 12:23:50.495283 2026] [:error] [pid 56066:tid 56141] [client 45.133.5.168:63055] [client 45.133.5.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-bindings/backup/js/build/kys/admin.php"] [unique_id "afwT1kYS8DGwDvklLv6zMQAAANI"]
[Thu May 07 12:23:50.708057 2026] [:error] [pid 56065:tid 56119] [client 45.133.5.172:22583] [client 45.133.5.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/src/v1/dist/build/uols/"] [unique_id "afwT1ndV4hYThdnhfxDbzgAAAJc"]
[Thu May 07 12:23:50.919946 2026] [:error] [pid 56064:tid 56091] [client 45.133.5.222:58153] [client 45.133.5.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/user/css/cache/piwk/admin.php"] [unique_id "afwT1isGkZZUEf_7QCMm2gAAABY"]
[Thu May 07 12:23:51.155568 2026] [:error] [pid 1143:tid 1149] [client 45.133.5.189:56995] [client 45.133.5.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/plugins/test.php"] [unique_id "afwT15b7qeI8X5VYRr55_AAAAQQ"]
[Thu May 07 12:23:51.371587 2026] [:error] [pid 56065:tid 56103] [client 45.133.5.205:35441] [client 45.133.5.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/themes/maintenance.php"] [unique_id "afwT13dV4hYThdnhfxDbzwAAAIc"]
[Thu May 07 12:23:51.583823 2026] [:error] [pid 1143:tid 1146] [client 45.133.5.175:44245] [client 45.133.5.175] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins_new/sitepress-multilingual-cms/classes/plugins/about.php"] [unique_id "afwT15b7qeI8X5VYRr55_gAAAQE"]
[Thu May 07 12:23:51.794961 2026] [:error] [pid 1143:tid 1160] [client 45.133.5.180:54209] [client 45.133.5.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins_new/wordpress-seo/admin/import/plugins/wp-blog-header.php"] [unique_id "afwT15b7qeI8X5VYRr55_wAAAQ8"]
[Thu May 07 12:23:52.008605 2026] [:error] [pid 1143:tid 1162] [client 45.133.5.229:51535] [client 45.133.5.229] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/cs.php"] [unique_id "afwT2Jb7qeI8X5VYRr56AAAAARE"]
[Thu May 07 12:23:52.219791 2026] [:error] [pid 1143:tid 1159] [client 45.133.5.175:60301] [client 45.133.5.175] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/IXR/met/uploads/"] [unique_id "afwT2Jb7qeI8X5VYRr56AQAAAQ4"]
[Thu May 07 12:23:52.457034 2026] [:error] [pid 56064:tid 56077] [client 45.133.5.178:45263] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/wdf.php"] [unique_id "afwT2CsGkZZUEf_7QCMm3gAAAAg"]
[Thu May 07 12:23:52.670397 2026] [:error] [pid 1143:tid 1167] [client 45.133.5.164:65189] [client 45.133.5.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/koiy.php"] [unique_id "afwT2Jb7qeI8X5VYRr56AwAAARY"]
[Thu May 07 12:23:53.260120 2026] [:error] [pid 1143:tid 1156] [client 45.133.5.207:46705] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/query/"] [unique_id "afwT2Zb7qeI8X5VYRr56BQAAAQs"]
[Thu May 07 12:23:53.500655 2026] [:error] [pid 1143:tid 1161] [client 45.133.5.165:55467] [client 45.133.5.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/spacer/"] [unique_id "afwT2Zb7qeI8X5VYRr56BgAAARA"]
[Thu May 07 12:23:53.712372 2026] [:error] [pid 1143:tid 1150] [client 45.133.5.178:30353] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/l10n/"] [unique_id "afwT2Zb7qeI8X5VYRr56BwAAAQU"]
[Thu May 07 12:23:53.959971 2026] [:error] [pid 1143:tid 1148] [client 45.133.5.202:32845] [client 45.133.5.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/plugins/media/v3/js/build/icdxa/"] [unique_id "afwT2Zb7qeI8X5VYRr56CAAAAQM"]
[Thu May 07 12:23:54.172279 2026] [:error] [pid 1143:tid 1165] [client 45.133.5.194:52581] [client 45.133.5.194] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/plugins/v3/data/v1/css/jmy/msl/"] [unique_id "afwT2pb7qeI8X5VYRr56CQAAARQ"]
[Thu May 07 12:23:54.384108 2026] [:error] [pid 1143:tid 1153] [client 45.133.5.167:29543] [client 45.133.5.167] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade/build/css/cache/img/src/backup/utt/admin.php"] [unique_id "afwT2pb7qeI8X5VYRr56CgAAAQg"]
[Thu May 07 12:23:54.595914 2026] [:error] [pid 56064:tid 56079] [client 45.133.5.177:29907] [client 45.133.5.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/social-links/admin.php"] [unique_id "afwT2isGkZZUEf_7QCMm4AAAAAo"]
[Thu May 07 12:23:54.807042 2026] [:error] [pid 1143:tid 1147] [client 45.133.5.193:32041] [client 45.133.5.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/admin-wolf.php"] [unique_id "afwT2pb7qeI8X5VYRr56CwAAAQI"]
[Thu May 07 12:23:55.054204 2026] [:error] [pid 56066:tid 56123] [client 45.133.5.222:22919] [client 45.133.5.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "afwT20YS8DGwDvklLv6zNAAAAMA"]
[Thu May 07 12:23:55.266630 2026] [:error] [pid 56065:tid 56113] [client 45.133.5.209:44315] [client 45.133.5.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/astra/assets/css/minified/system_core.php"] [unique_id "afwT23dV4hYThdnhfxDb0QAAAJE"]
[Thu May 07 12:23:55.479583 2026] [:error] [pid 56065:tid 56116] [client 45.133.5.208:50625] [client 45.133.5.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/system_core.php"] [unique_id "afwT23dV4hYThdnhfxDb0gAAAJQ"]
[Thu May 07 12:23:55.692609 2026] [:error] [pid 1143:tid 1163] [client 45.133.5.183:43685] [client 45.133.5.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-content/themes/wp-config-backup.php"] [unique_id "afwT25b7qeI8X5VYRr56DAAAARI"]
[Thu May 07 12:23:55.904694 2026] [:error] [pid 1143:tid 1169] [client 45.133.5.180:40883] [client 45.133.5.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/theme/about.php"] [unique_id "afwT25b7qeI8X5VYRr56DQAAARg"]
[Thu May 07 12:23:56.166996 2026] [:error] [pid 1143:tid 1155] [client 45.133.5.224:42465] [client 45.133.5.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/sinatra/inc/customizer/controls/color/about.php"] [unique_id "afwT3Jb7qeI8X5VYRr56DgAAAQo"]
[Thu May 07 12:23:56.379954 2026] [:error] [pid 56150:tid 56152] [client 45.133.5.206:22577] [client 45.133.5.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/blocksy/inc/panel-builder/footer/widget-area-3/"] [unique_id "afwT3Nu4duXJJeTigXQ7cQAAAEA"]
[Thu May 07 12:23:56.592443 2026] [:error] [pid 56150:tid 56162] [client 45.133.5.208:29921] [client 45.133.5.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/crio/woocommerce/notices/"] [unique_id "afwT3Nu4duXJJeTigXQ7cgAAAEo"]
[Thu May 07 12:23:56.804353 2026] [:error] [pid 56150:tid 56166] [client 45.133.5.206:39263] [client 45.133.5.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/hestia/inc/views/blog/"] [unique_id "afwT3Nu4duXJJeTigXQ7cwAAAE4"]
[Thu May 07 12:23:57.015385 2026] [:error] [pid 56150:tid 56175] [client 45.133.5.180:49011] [client 45.133.5.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/fortified-child/docs/js/omelv/"] [unique_id "afwT3du4duXJJeTigXQ7dAAAAFc"]
[Thu May 07 12:23:57.252566 2026] [:error] [pid 56150:tid 56170] [client 45.133.5.194:33775] [client 45.133.5.194] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/maintenance.php"] [unique_id "afwT3du4duXJJeTigXQ7dQAAAFI"]
[Thu May 07 12:23:57.461672 2026] [:error] [pid 1143:tid 1150] [client 45.133.5.165:46833] [client 45.133.5.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyone/content-index.php"] [unique_id "afwT3Zb7qeI8X5VYRr56EAAAAQU"]
[Thu May 07 12:23:59.153546 2026] [:error] [pid 56150:tid 56169] [client 45.133.5.214:43919] [client 45.133.5.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/proton/content-index.php"] [unique_id "afwT39u4duXJJeTigXQ7dgAAAFE"]
[Thu May 07 12:23:59.365091 2026] [:error] [pid 56150:tid 56172] [client 45.133.5.171:61483] [client 45.133.5.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentythree/patterns/"] [unique_id "afwT39u4duXJJeTigXQ7eAAAAFQ"]
[Thu May 07 12:23:59.575979 2026] [:error] [pid 56150:tid 56167] [client 45.133.5.187:31777] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/assets/fonts/inter/"] [unique_id "afwT39u4duXJJeTigXQ7eQAAAE8"]
[Thu May 07 12:23:59.786834 2026] [:error] [pid 56150:tid 56157] [client 45.133.5.219:31181] [client 45.133.5.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/yootheme/content-index.php"] [unique_id "afwT39u4duXJJeTigXQ7egAAAEU"]
[Thu May 07 12:23:59.998479 2026] [:error] [pid 56065:tid 56102] [client 45.133.5.170:56569] [client 45.133.5.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/security.php"] [unique_id "afwT33dV4hYThdnhfxDb1AAAAIY"]
[Thu May 07 12:24:00.222907 2026] [:error] [pid 56065:tid 56108] [client 45.133.5.208:64487] [client 45.133.5.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/promobox/"] [unique_id "afwT4HdV4hYThdnhfxDb1QAAAIw"]
[Thu May 07 12:24:00.504358 2026] [:error] [pid 56064:tid 56093] [client 45.133.5.195:53413] [client 45.133.5.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/wp-signup.php"] [unique_id "afwT4CsGkZZUEf_7QCMm4gAAABg"]
[Thu May 07 12:24:00.724298 2026] [:error] [pid 56066:tid 56139] [client 45.133.5.203:24529] [client 45.133.5.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/wp-config-backup.php"] [unique_id "afwT4EYS8DGwDvklLv6zOAAAANA"]
[Thu May 07 12:24:00.957222 2026] [:error] [pid 1143:tid 1149] [client 45.133.5.230:40539] [client 45.133.5.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/master-blog/content-none-new-compiler.php"] [unique_id "afwT4Jb7qeI8X5VYRr56EQAAAQQ"]
[Thu May 07 12:24:01.168415 2026] [:error] [pid 1143:tid 1146] [client 45.133.5.164:40173] [client 45.133.5.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/villagio-child/admin.php"] [unique_id "afwT4Zb7qeI8X5VYRr56EwAAAQE"]
[Thu May 07 12:24:01.383407 2026] [:error] [pid 56065:tid 56107] [client 45.133.5.229:25619] [client 45.133.5.229] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentynineteen/sass/site/primary/"] [unique_id "afwT4XdV4hYThdnhfxDb1gAAAIs"]
[Thu May 07 12:24:01.596417 2026] [:error] [pid 1143:tid 1160] [client 45.133.5.216:24145] [client 45.133.5.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-content/themes/admin.php"] [unique_id "afwT4Zb7qeI8X5VYRr56FAAAAQ8"]
[Thu May 07 12:24:01.808326 2026] [:error] [pid 1143:tid 1167] [client 45.133.5.193:44145] [client 45.133.5.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/consultstreet/config.php"] [unique_id "afwT4Zb7qeI8X5VYRr56FwAAARY"]
[Thu May 07 12:24:02.020638 2026] [:error] [pid 1143:tid 1168] [client 45.133.5.222:30895] [client 45.133.5.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/blogger-buzz/welcome/js/"] [unique_id "afwT4pb7qeI8X5VYRr56GQAAARc"]
[Thu May 07 12:24:02.261395 2026] [:error] [pid 1143:tid 1158] [client 45.133.5.206:38781] [client 45.133.5.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/mesmerize/page-templates/"] [unique_id "afwT4pb7qeI8X5VYRr56GwAAAQ0"]
[Thu May 07 12:24:02.472812 2026] [:error] [pid 56064:tid 56070] [client 45.133.5.197:22305] [client 45.133.5.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/theme-check/theme-check.php"] [unique_id "afwT4isGkZZUEf_7QCMm5AAAAAE"]
[Thu May 07 12:24:02.684003 2026] [:error] [pid 56064:tid 56076] [client 45.133.5.207:42767] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/hello-elementor/template-parts/"] [unique_id "afwT4isGkZZUEf_7QCMm5QAAAAc"]
[Thu May 07 12:24:02.897634 2026] [:error] [pid 56064:tid 56072] [client 45.133.5.220:44751] [client 45.133.5.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/Divi/includes/builder/post/taxonomy/"] [unique_id "afwT4isGkZZUEf_7QCMm5wAAAAM"]
[Thu May 07 12:24:03.111116 2026] [:error] [pid 56066:tid 56133] [client 45.133.5.200:28505] [client 45.133.5.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/system.php"] [unique_id "afwT40YS8DGwDvklLv6zOgAAAMo"]
[Thu May 07 12:24:03.356344 2026] [:error] [pid 56064:tid 56087] [client 45.133.5.172:54563] [client 45.133.5.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/module.php"] [unique_id "afwT4ysGkZZUEf_7QCMm6gAAABI"]
[Thu May 07 12:24:03.670704 2026] [:error] [pid 56065:tid 56105] [client 45.133.5.168:29143] [client 45.133.5.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/test.php"] [unique_id "afwT43dV4hYThdnhfxDb2wAAAIk"]
[Thu May 07 12:24:04.088341 2026] [:error] [pid 56066:tid 56132] [client 45.133.5.169:51485] [client 45.133.5.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/blog-kit/inc/demo/demo-content/"] [unique_id "afwT5EYS8DGwDvklLv6zPAAAAMk"]
[Thu May 07 12:24:04.568725 2026] [:error] [pid 1143:tid 1165] [client 45.133.5.183:49651] [client 45.133.5.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/flatsome/inc/"] [unique_id "afwT5Jb7qeI8X5VYRr56HQAAARQ"]
[Thu May 07 12:24:04.780459 2026] [:error] [pid 56065:tid 56119] [client 45.133.5.167:45463] [client 45.133.5.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/config.php"] [unique_id "afwT5HdV4hYThdnhfxDb3AAAAJc"]
[Thu May 07 12:24:04.991063 2026] [:error] [pid 1143:tid 1160] [client 45.133.5.183:51067] [client 45.133.5.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/pomo/config.php"] [unique_id "afwT5Jb7qeI8X5VYRr56HgAAAQ8"]
[Thu May 07 12:24:05.202147 2026] [:error] [pid 1143:tid 1167] [client 45.133.5.177:32175] [client 45.133.5.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/providers/config.php"] [unique_id "afwT5Zb7qeI8X5VYRr56IQAAARY"]
[Thu May 07 12:24:05.453392 2026] [:error] [pid 1143:tid 1156] [client 45.133.5.220:60361] [client 45.133.5.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/config.php"] [unique_id "afwT5Zb7qeI8X5VYRr56IgAAAQs"]
[Thu May 07 12:24:05.665071 2026] [:error] [pid 1143:tid 1168] [client 45.133.5.193:58455] [client 45.133.5.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/bootstrap.php"] [unique_id "afwT5Zb7qeI8X5VYRr56IwAAARc"]
[Thu May 07 12:24:05.879443 2026] [:error] [pid 56065:tid 56101] [client 45.133.5.200:32019] [client 45.133.5.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/plugins/panel.php"] [unique_id "afwT5XdV4hYThdnhfxDb3gAAAIU"]
[Thu May 07 12:24:06.096393 2026] [:error] [pid 56150:tid 56160] [client 45.133.5.210:43469] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/"] [unique_id "afwT5tu4duXJJeTigXQ7ewAAAEg"]
[Thu May 07 12:24:06.356651 2026] [:error] [pid 56150:tid 56171] [client 45.133.5.200:21019] [client 45.133.5.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/class-wp-image.php"] [unique_id "afwT5tu4duXJJeTigXQ7fAAAAFM"]
[Thu May 07 12:24:06.567987 2026] [:error] [pid 56150:tid 56162] [client 45.133.5.167:52645] [client 45.133.5.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/chosen.php"] [unique_id "afwT5tu4duXJJeTigXQ7fQAAAEo"]
[Thu May 07 12:24:06.779469 2026] [:error] [pid 56066:tid 56131] [client 45.133.5.188:36303] [client 45.133.5.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/php-compat/shadow-bot.php"] [unique_id "afwT5kYS8DGwDvklLv6zPwAAAMg"]
[Thu May 07 12:24:06.992584 2026] [:error] [pid 1143:tid 1150] [client 45.133.5.209:56139] [client 45.133.5.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cgi-bin/config.php"] [unique_id "afwT5pb7qeI8X5VYRr56JwAAAQU"]
[Thu May 07 12:24:07.203116 2026] [:error] [pid 56150:tid 56161] [client 45.133.5.197:35229] [client 45.133.5.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/config.php"] [unique_id "afwT59u4duXJJeTigXQ7gAAAAEk"]
[Thu May 07 12:24:07.414230 2026] [:error] [pid 56065:tid 56113] [client 45.133.5.179:29925] [client 45.133.5.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/src/config.php"] [unique_id "afwT53dV4hYThdnhfxDb4QAAAJE"]
[Thu May 07 12:24:07.653861 2026] [:error] [pid 56150:tid 56170] [client 45.133.5.189:44673] [client 45.133.5.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/config.php"] [unique_id "afwT59u4duXJJeTigXQ7gQAAAFI"]
[Thu May 07 12:24:07.864249 2026] [:error] [pid 56150:tid 56159] [client 45.133.5.182:63285] [client 45.133.5.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/config.php"] [unique_id "afwT59u4duXJJeTigXQ7hAAAAEc"]
[Thu May 07 12:24:08.080833 2026] [:error] [pid 56150:tid 56157] [client 45.133.5.178:62855] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/config.php"] [unique_id "afwT6Nu4duXJJeTigXQ7hgAAAEU"]
[Thu May 07 12:24:08.295311 2026] [:error] [pid 56064:tid 56083] [client 45.133.5.178:33465] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/interactivity-api/config.php"] [unique_id "afwT6CsGkZZUEf_7QCMm7QAAAA4"]
[Thu May 07 12:24:08.506743 2026] [:error] [pid 56066:tid 56142] [client 45.133.5.221:35711] [client 45.133.5.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/config.php"] [unique_id "afwT6EYS8DGwDvklLv6zQQAAANM"]
[Thu May 07 12:24:08.717702 2026] [:error] [pid 56064:tid 56084] [client 45.133.5.207:60433] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/config.php"] [unique_id "afwT6CsGkZZUEf_7QCMm8QAAAA8"]
[Thu May 07 12:24:08.954600 2026] [:error] [pid 1143:tid 1148] [client 45.133.5.194:54681] [client 45.133.5.194] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/plugins/config.php"] [unique_id "afwT6Jb7qeI8X5VYRr56KQAAAQM"]
[Thu May 07 12:24:09.165720 2026] [:error] [pid 56150:tid 56162] [client 45.133.5.169:34227] [client 45.133.5.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/config.php"] [unique_id "afwT6du4duXJJeTigXQ7jAAAAEo"]
[Thu May 07 12:24:09.377545 2026] [:error] [pid 1143:tid 1147] [client 45.133.5.162:31583] [client 45.133.5.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/cache/config.php"] [unique_id "afwT6Zb7qeI8X5VYRr56KwAAAQI"]
[Thu May 07 12:24:09.588897 2026] [:error] [pid 1143:tid 1156] [client 45.133.5.212:56587] [client 45.133.5.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-cloudflare-super-page-cache/config.php"] [unique_id "afwT6Zb7qeI8X5VYRr56LQAAAQs"]
[Thu May 07 12:24:09.799858 2026] [:error] [pid 56150:tid 56170] [client 45.133.5.164:20995] [client 45.133.5.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/library/"] [unique_id "afwT6du4duXJJeTigXQ7kAAAAFI"]
[Thu May 07 12:24:10.011833 2026] [:error] [pid 56150:tid 56167] [client 45.133.5.187:29739] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/abilities-api/"] [unique_id "afwT6tu4duXJJeTigXQ7kwAAAE8"]
[Thu May 07 12:24:10.265968 2026] [:error] [pid 56065:tid 56115] [client 45.133.5.192:47799] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/loco/"] [unique_id "afwT6ndV4hYThdnhfxDb4gAAAJM"]
[Thu May 07 12:24:10.480212 2026] [:error] [pid 56066:tid 56147] [client 45.133.5.183:61709] [client 45.133.5.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade-temp-backup/"] [unique_id "afwT6kYS8DGwDvklLv6zSQAAANg"]
[Thu May 07 12:24:10.693734 2026] [:error] [pid 56065:tid 56111] [client 45.133.5.175:42873] [client 45.133.5.175] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/class-theme-installer-skin-client.php"] [unique_id "afwT6ndV4hYThdnhfxDb4wAAAI8"]
[Thu May 07 12:24:10.908342 2026] [:error] [pid 1143:tid 1158] [client 45.133.5.212:56259] [client 45.133.5.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-recovery-mode-link-service-edit.php"] [unique_id "afwT6pb7qeI8X5VYRr56MwAAAQ0"]
[Thu May 07 12:24:11.119685 2026] [:error] [pid 1143:tid 1146] [client 45.133.5.210:31351] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/user-new-reference.php"] [unique_id "afwT65b7qeI8X5VYRr56NQAAAQE"]
[Thu May 07 12:24:11.355553 2026] [:error] [pid 1143:tid 1148] [client 45.133.5.173:32181] [client 45.133.5.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/vendor/stripe/stripe-php/lib/FinancialConnections/"] [unique_id "afwT65b7qeI8X5VYRr56NwAAAQM"]
[Thu May 07 12:24:11.567366 2026] [:error] [pid 56065:tid 56097] [client 45.133.5.165:29325] [client 45.133.5.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/vendor/stripe/stripe-php/lib/Service/FinancialConnections/"] [unique_id "afwT63dV4hYThdnhfxDb5AAAAIE"]
[Thu May 07 12:24:11.778757 2026] [:error] [pid 56150:tid 56162] [client 45.133.5.170:20893] [client 45.133.5.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/post-excerpt-meta.php"] [unique_id "afwT69u4duXJJeTigXQ7mQAAAEo"]
[Thu May 07 12:24:11.994183 2026] [:error] [pid 56064:tid 56091] [client 45.133.5.196:34031] [client 45.133.5.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-http.php"] [unique_id "afwT6ysGkZZUEf_7QCMm-gAAABY"]
[Thu May 07 12:24:12.208980 2026] [:error] [pid 56150:tid 56161] [client 45.133.5.197:47983] [client 45.133.5.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/admin.php"] [unique_id "afwT7Nu4duXJJeTigXQ7mwAAAEk"]
[Thu May 07 12:24:12.456296 2026] [:error] [pid 56064:tid 56078] [client 45.133.5.222:23015] [client 45.133.5.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/admin.php"] [unique_id "afwT7CsGkZZUEf_7QCMm-wAAAAk"]
[Thu May 07 12:24:12.667381 2026] [:error] [pid 56150:tid 56175] [client 45.133.5.194:42683] [client 45.133.5.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "afwT7Nu4duXJJeTigXQ7nQAAAFc"]
[Thu May 07 12:24:12.878997 2026] [:error] [pid 56150:tid 56169] [client 45.133.5.205:47937] [client 45.133.5.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/thickbox/logs1.php"] [unique_id "afwT7Nu4duXJJeTigXQ7oQAAAFE"]
[Thu May 07 12:24:13.093980 2026] [:error] [pid 56150:tid 56159] [client 45.133.5.225:37511] [client 45.133.5.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/admin.php"] [unique_id "afwT7du4duXJJeTigXQ7ogAAAEc"]
[Thu May 07 12:24:13.309223 2026] [:error] [pid 56066:tid 56140] [client 45.133.5.229:58899] [client 45.133.5.229] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/xy.php"] [unique_id "afwT7UYS8DGwDvklLv6zTwAAANE"]
[Thu May 07 12:24:13.520972 2026] [:error] [pid 56064:tid 56081] [client 45.133.5.191:58113] [client 45.133.5.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/xy.php"] [unique_id "afwT7SsGkZZUEf_7QCMm_gAAAAw"]
[Thu May 07 12:24:13.754213 2026] [:error] [pid 56065:tid 56099] [client 45.133.5.169:20641] [client 45.133.5.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/footer-class.php"] [unique_id "afwT7XdV4hYThdnhfxDb5gAAAIM"]
[Thu May 07 12:24:13.971642 2026] [:error] [pid 1143:tid 1156] [client 45.133.5.221:59533] [client 45.133.5.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/good.php"] [unique_id "afwT7Zb7qeI8X5VYRr56OQAAAQs"]
[Thu May 07 12:24:14.182295 2026] [:error] [pid 1143:tid 1162] [client 45.133.5.216:23633] [client 45.133.5.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/editor/"] [unique_id "afwT7pb7qeI8X5VYRr56OgAAARE"]
[Thu May 07 12:24:14.412408 2026] [:error] [pid 56065:tid 56114] [client 45.133.5.228:34693] [client 45.133.5.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/profile/admin.php"] [unique_id "afwT7ndV4hYThdnhfxDb6AAAAJI"]
[Thu May 07 12:24:14.659603 2026] [:error] [pid 1143:tid 1166] [client 45.133.5.192:27743] [client 45.133.5.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/summia/"] [unique_id "afwT7pb7qeI8X5VYRr56OwAAARU"]
[Thu May 07 12:24:14.870625 2026] [:error] [pid 56064:tid 56090] [client 45.133.5.191:45569] [client 45.133.5.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-content/languages/config.php"] [unique_id "afwT7isGkZZUEf_7QCMnAAAAABU"]
[Thu May 07 12:24:15.081700 2026] [:error] [pid 56150:tid 56162] [client 45.133.5.209:31813] [client 45.133.5.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-content/admin.php"] [unique_id "afwT79u4duXJJeTigXQ7owAAAEo"]
[Thu May 07 12:24:15.308544 2026] [:error] [pid 56150:tid 56166] [client 45.133.5.178:52707] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/autoload_classmap.php"] [unique_id "afwT79u4duXJJeTigXQ7pQAAAE4"]
[Thu May 07 12:24:15.558355 2026] [:error] [pid 56064:tid 56074] [client 45.133.5.173:61639] [client 45.133.5.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/h2.php"] [unique_id "afwT7ysGkZZUEf_7QCMnAQAAAAU"]
[Thu May 07 12:24:15.782476 2026] [:error] [pid 56066:tid 56127] [client 45.133.5.214:62639] [client 45.133.5.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/mu-plugins/chosen.php"] [unique_id "afwT70YS8DGwDvklLv6zUQAAAMQ"]
[Thu May 07 12:24:15.994437 2026] [:error] [pid 1143:tid 1150] [client 45.133.5.178:50901] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade-temp-backup/autoload_classmap.php"] [unique_id "afwT75b7qeI8X5VYRr56PwAAAQU"]
[Thu May 07 12:24:16.208632 2026] [:error] [pid 1143:tid 1159] [client 45.133.5.187:44265] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/Base.php"] [unique_id "afwT8Jb7qeI8X5VYRr56QQAAAQ4"]
[Thu May 07 12:24:16.468147 2026] [:error] [pid 56150:tid 56159] [client 45.133.5.195:20019] [client 45.133.5.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins.bk/contact-form-7/includes/js/jquery-ui/themes/admin.php"] [unique_id "afwT8Nu4duXJJeTigXQ7rgAAAEc"]
[Thu May 07 12:24:16.686007 2026] [:error] [pid 56065:tid 56109] [client 45.133.5.189:53391] [client 45.133.5.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins.bk/js_composer/include/classes/vendors/plugins/system.php"] [unique_id "afwT8HdV4hYThdnhfxDb6wAAAI0"]
[Thu May 07 12:24:17.160862 2026] [:error] [pid 56150:tid 56176] [client 45.133.5.173:63075] [client 45.133.5.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins.bk/wordpress-seo/admin/import/plugins/maintenance.php"] [unique_id "afwT8du4duXJJeTigXQ7rwAAAFg"]
[Thu May 07 12:24:17.591558 2026] [:error] [pid 56066:tid 56138] [client 45.133.5.189:44751] [client 45.133.5.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/plugins/wp-mail.php"] [unique_id "afwT8UYS8DGwDvklLv6zVAAAAM8"]
[Thu May 07 12:24:17.804735 2026] [:error] [pid 56066:tid 56137] [client 45.133.5.184:36811] [client 45.133.5.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/wp-conflg.php"] [unique_id "afwT8UYS8DGwDvklLv6zVQAAAM4"]
[Thu May 07 12:24:18.052845 2026] [:error] [pid 56065:tid 56116] [client 45.133.5.207:50027] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/wp-config.php"] [unique_id "afwT8ndV4hYThdnhfxDb7AAAAJQ"]
[Thu May 07 12:24:18.266788 2026] [:error] [pid 56066:tid 56147] [client 45.133.5.187:42953] [client 45.133.5.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/user/lock.php"] [unique_id "afwT8kYS8DGwDvklLv6zVwAAANg"]
[Thu May 07 12:24:18.478808 2026] [:error] [pid 1143:tid 1148] [client 45.133.5.189:25975] [client 45.133.5.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/com.php"] [unique_id "afwT8pb7qeI8X5VYRr56QwAAAQM"]
[Thu May 07 12:24:18.970011 2026] [:error] [pid 56150:tid 56173] [client 45.133.5.228:26935] [client 45.133.5.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/xxx.php"] [unique_id "afwT8tu4duXJJeTigXQ7sgAAAFU"]
[Thu May 07 12:24:19.496823 2026] [:error] [pid 56150:tid 56170] [client 45.133.5.207:28985] [client 45.133.5.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/network/uploads/system.php"] [unique_id "afwT89u4duXJJeTigXQ7tAAAAFI"]
[Thu May 07 12:24:19.798517 2026] [:error] [pid 56065:tid 56115] [client 45.133.5.202:21535] [client 45.133.5.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/plugins/colors/"] [unique_id "afwT83dV4hYThdnhfxDb7QAAAJM"]
[Thu May 07 12:24:20.010500 2026] [:error] [pid 56066:tid 56132] [client 45.133.5.208:47137] [client 45.133.5.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/backups-dup-pro/imports/network/"] [unique_id "afwT9EYS8DGwDvklLv6zWgAAAMk"]
[Thu May 07 12:24:20.255765 2026] [:error] [pid 56150:tid 56167] [client 45.133.5.220:43687] [client 45.133.5.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/ai1wm-backups/includes/"] [unique_id "afwT9Nu4duXJJeTigXQ7tgAAAE8"]
[Thu May 07 12:24:20.476671 2026] [:error] [pid 56150:tid 56174] [client 45.133.5.221:46839] [client 45.133.5.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/gettest.php"] [unique_id "afwT9Nu4duXJJeTigXQ7uAAAAFY"]
[Thu May 07 12:24:20.687430 2026] [:error] [pid 56150:tid 56168] [client 45.133.5.167:39561] [client 45.133.5.167] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/dx.php"] [unique_id "afwT9Nu4duXJJeTigXQ7uQAAAFA"]
[Thu May 07 12:24:20.899094 2026] [:error] [pid 56066:tid 56145] [client 45.133.5.178:55833] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/panel.php"] [unique_id "afwT9EYS8DGwDvklLv6zWwAAANY"]
[Thu May 07 12:24:21.176543 2026] [:error] [pid 56066:tid 56142] [client 45.133.5.181:29837] [client 45.133.5.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/wp-themes.php"] [unique_id "afwT9UYS8DGwDvklLv6zXgAAANM"]
[Thu May 07 12:24:21.388865 2026] [:error] [pid 56066:tid 56146] [client 45.133.5.188:21089] [client 45.133.5.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/widgets/maint/"] [unique_id "afwT9UYS8DGwDvklLv6zXwAAANc"]
[Thu May 07 12:24:21.600487 2026] [:error] [pid 56064:tid 56078] [client 45.133.5.202:20005] [client 45.133.5.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Exception/Transport/"] [unique_id "afwT9SsGkZZUEf_7QCMnCAAAAAk"]
[Thu May 07 12:24:21.812029 2026] [:error] [pid 56064:tid 56071] [client 45.133.5.185:44883] [client 45.133.5.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/"] [unique_id "afwT9SsGkZZUEf_7QCMnCQAAAAI"]
[Thu May 07 12:24:22.022597 2026] [:error] [pid 56064:tid 56083] [client 45.133.5.179:48237] [client 45.133.5.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/wp-sing.php"] [unique_id "afwT9isGkZZUEf_7QCMnCwAAAA4"]
[Thu May 07 12:24:22.252899 2026] [:error] [pid 56150:tid 56162] [client 45.133.5.162:31127] [client 45.133.5.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/button/"] [unique_id "afwT9tu4duXJJeTigXQ7ugAAAEo"]
[Thu May 07 12:24:22.465769 2026] [:error] [pid 56150:tid 56166] [client 45.133.5.203:64781] [client 45.133.5.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/media-text/"] [unique_id "afwT9tu4duXJJeTigXQ7uwAAAE4"]
[Thu May 07 12:24:22.682460 2026] [:error] [pid 1143:tid 1163] [client 45.133.5.170:24817] [client 45.133.5.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/missing/"] [unique_id "afwT9pb7qeI8X5VYRr56RQAAARI"]
[Thu May 07 12:24:22.896510 2026] [:error] [pid 56150:tid 56175] [client 45.133.5.225:45559] [client 45.133.5.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wmore1.php"] [unique_id "afwT9tu4duXJJeTigXQ7vgAAAFc"]
[Thu May 07 12:24:23.153678 2026] [:error] [pid 56150:tid 56153] [client 45.133.5.184:32299] [client 45.133.5.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/img/content/media/lnl/"] [unique_id "afwT99u4duXJJeTigXQ7wAAAAEE"]
[Thu May 07 12:24:23.366019 2026] [:error] [pid 56065:tid 56118] [client 45.133.5.162:54595] [client 45.133.5.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/gallery/"] [unique_id "afwT93dV4hYThdnhfxDb8QAAAJY"]
[Thu May 07 12:24:23.576446 2026] [:error] [pid 1143:tid 1167] [client 45.133.5.184:23187] [client 45.133.5.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/l10n/includes/content/v2/uploads/docs/yat/admin.php"] [unique_id "afwT95b7qeI8X5VYRr56RgAAARY"]
[Thu May 07 12:24:23.787144 2026] [:error] [pid 56150:tid 56167] [client 45.133.5.210:20909] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cache/adminkontol.php"] [unique_id "afwT99u4duXJJeTigXQ7wwAAAE8"]
[Thu May 07 12:24:23.998694 2026] [:error] [pid 56065:tid 56099] [client 45.133.5.203:33485] [client 45.133.5.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/vx.php"] [unique_id "afwT93dV4hYThdnhfxDb8wAAAIM"]
[Thu May 07 12:24:24.209560 2026] [:error] [pid 56064:tid 56082] [client 45.133.5.195:46041] [client 45.133.5.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/database/"] [unique_id "afwT-CsGkZZUEf_7QCMnDwAAAA0"]
[Thu May 07 12:24:24.459811 2026] [:error] [pid 56065:tid 56114] [client 45.133.5.228:27877] [client 45.133.5.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/uploads/system.php"] [unique_id "afwT-HdV4hYThdnhfxDb9AAAAJI"]
[Thu May 07 12:24:24.671164 2026] [:error] [pid 56150:tid 56174] [client 45.133.5.196:35021] [client 45.133.5.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/block/img/themes/"] [unique_id "afwT-Nu4duXJJeTigXQ7xAAAAFY"]
[Thu May 07 12:24:24.883171 2026] [:error] [pid 56150:tid 56168] [client 45.133.5.177:42381] [client 45.133.5.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/preformatted/"] [unique_id "afwT-Nu4duXJJeTigXQ7xQAAAFA"]
[Thu May 07 12:24:26.775628 2026] [:error] [pid 56065:tid 56116] [client 45.133.5.181:48569] [client 45.133.5.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/themes/wp-load.php"] [unique_id "afwT-ndV4hYThdnhfxDb-AAAAJQ"]
[Thu May 07 12:24:26.986130 2026] [:error] [pid 56064:tid 56075] [client 45.133.5.209:32467] [client 45.133.5.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/plugins/home.php"] [unique_id "afwT-isGkZZUEf_7QCMnEgAAAAY"]
[Thu May 07 12:24:27.197920 2026] [:error] [pid 56150:tid 56157] [client 45.133.5.171:54449] [client 45.133.5.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/themes/"] [unique_id "afwT-9u4duXJJeTigXQ7zwAAAEU"]
[Thu May 07 12:24:27.408508 2026] [:error] [pid 56064:tid 56080] [client 45.133.5.189:27695] [client 45.133.5.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/system_core.php"] [unique_id "afwT-ysGkZZUEf_7QCMnFgAAAAs"]
[Thu May 07 12:24:27.650594 2026] [:error] [pid 56064:tid 56071] [client 45.133.5.168:36335] [client 45.133.5.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/maintenance.php"] [unique_id "afwT-ysGkZZUEf_7QCMnFwAAAAI"]
[Thu May 07 12:24:27.872584 2026] [:error] [pid 56065:tid 56111] [client 45.133.5.230:52843] [client 45.133.5.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/edit-tags.php"] [unique_id "afwT-3dV4hYThdnhfxDb-QAAAI8"]
[Thu May 07 12:24:28.085026 2026] [:error] [pid 56065:tid 56104] [client 45.133.5.178:32979] [client 45.133.5.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/w.php"] [unique_id "afwT_HdV4hYThdnhfxDb-wAAAIg"]
[Thu May 07 12:24:28.296880 2026] [:error] [pid 1143:tid 1145] [client 45.133.5.185:33447] [client 45.133.5.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-http-client.php"] [unique_id "afwT_Jb7qeI8X5VYRr56SAAAAQA"]
[Thu May 07 12:24:28.509148 2026] [:error] [pid 1143:tid 1154] [client 45.133.5.197:32067] [client 45.133.5.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/class-wp-http-client.php"] [unique_id "afwT_Jb7qeI8X5VYRr56SQAAAQk"]
[Thu May 07 12:24:28.751789 2026] [:error] [pid 1143:tid 1155] [client 45.133.5.214:59067] [client 45.133.5.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/tag-cloud/"] [unique_id "afwT_Jb7qeI8X5VYRr56SgAAAQo"]
[Thu May 07 12:24:28.964749 2026] [:error] [pid 1143:tid 1158] [client 45.133.5.208:54807] [client 45.133.5.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/nic.php"] [unique_id "afwT_Jb7qeI8X5VYRr56TgAAAQ0"]
[Thu May 07 12:24:29.176026 2026] [:error] [pid 1143:tid 1153] [client 45.133.5.193:53951] [client 45.133.5.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/wp-conflg.php"] [unique_id "afwT_Zb7qeI8X5VYRr56UAAAAQg"]
[Thu May 07 12:24:29.388501 2026] [:error] [pid 56150:tid 56162] [client 45.133.5.229:49391] [client 45.133.5.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/wp-conflg.php"] [unique_id "afwT_du4duXJJeTigXQ76AAAAEo"]
[Thu May 07 12:24:29.600941 2026] [:error] [pid 1143:tid 1164] [client 45.133.5.181:23653] [client 45.133.5.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "afwT_Zb7qeI8X5VYRr56UwAAARM"]
[Thu May 07 12:24:29.813035 2026] [:error] [pid 56150:tid 56167] [client 45.133.5.195:64733] [client 45.133.5.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/autoload_classmap.php"] [unique_id "afwT_du4duXJJeTigXQ76QAAAE8"]
[Thu May 07 12:24:30.058129 2026] [:error] [pid 56150:tid 56158] [client 45.133.5.171:44701] [client 45.133.5.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "afwT_tu4duXJJeTigXQ76wAAAEY"]
[Thu May 07 12:24:30.270929 2026] [:error] [pid 56066:tid 56126] [client 45.133.5.220:40493] [client 45.133.5.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/themes/api.php"] [unique_id "afwT_kYS8DGwDvklLv6zZgAAAMM"]
[Thu May 07 12:24:30.554063 2026] [:error] [pid 56150:tid 56154] [client 45.133.5.222:43439] [client 45.133.5.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/plugins/core.php"] [unique_id "afwT_tu4duXJJeTigXQ77gAAAEI"]
[Thu May 07 12:24:30.779626 2026] [:error] [pid 56066:tid 56139] [client 45.133.5.168:56921] [client 45.133.5.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/components/wp-cron-activation.php"] [unique_id "afwT_kYS8DGwDvklLv6zZwAAANA"]
[Thu May 07 12:24:31.005657 2026] [:error] [pid 1143:tid 1169] [client 45.133.5.170:62207] [client 45.133.5.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/block-library/includes/"] [unique_id "afwT_5b7qeI8X5VYRr56WQAAARg"]
[Thu May 07 12:24:31.218400 2026] [:error] [pid 56066:tid 56123] [client 45.133.5.222:22865] [client 45.133.5.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/base-styles/user/"] [unique_id "afwT_0YS8DGwDvklLv6zcwAAAMA"]
[Thu May 07 12:24:31.466293 2026] [:error] [pid 1143:tid 1168] [client 45.133.5.210:61463] [client 45.133.5.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/abilities-api/Parse/"] [unique_id "afwT_5b7qeI8X5VYRr56agAAARc"]
[Thu May 07 12:24:31.679084 2026] [:error] [pid 1143:tid 1160] [client 45.133.5.220:58275] [client 45.133.5.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/providers/html-api/"] [unique_id "afwT_5b7qeI8X5VYRr56awAAAQ8"]
[Thu May 07 22:31:02.297171 2026] [:error] [pid 15631:tid 15709] [client 39.60.219.105:63433] [client 39.60.219.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.60.219.105, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "afyiJnvP1GkPUuuLfqVaFAAAANY"]
[Fri May 08 04:37:34.962302 2026] [:error] [pid 51008:tid 51060] [client 34.35.115.255:51072] [client 34.35.115.255] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "afz4DnB58C2Y1tgLtuLzNQAAAEs"]
[Fri May 08 11:17:38.746384 2026] [:error] [pid 61356:tid 61397] [client 35.240.173.90:34858] [client 35.240.173.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "af1V0ox3vpB8oWhUq2PgFQAAAck"]
[Fri May 08 13:44:32.783173 2026] [autoindex:error] [pid 51009:tid 51098] [client 4.193.137.131:14668] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri May 08 13:44:32.882521 2026] [autoindex:error] [pid 51009:tid 51084] [client 4.193.137.131:14668] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri May 08 14:44:02.406082 2026] [:error] [pid 61317:tid 61328] [client 34.85.141.99:50019] [client 34.85.141.99] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "af2GMs-fFk_CedOCOYuN1gAAAUg"]
[Fri May 08 14:44:03.288324 2026] [:error] [pid 51007:tid 51033] [client 34.85.141.99:59933] [client 34.85.141.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.85.141.99, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "af2GM1MagSGstWKyzzXB7QAAAAs"]
[Fri May 08 15:28:56.950521 2026] [:error] [pid 61355:tid 61364] [client 34.122.144.100:57722] [client 34.122.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "af2QuPkhJTi30CBXmMleowAAAYM"]
[Fri May 08 15:28:57.399315 2026] [:error] [pid 61317:tid 61344] [client 34.122.144.100:51004] [client 34.122.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "af2Quc-fFk_CedOCOYuUPgAAAVg"]
[Fri May 08 15:28:57.794286 2026] [:error] [pid 51009:tid 51089] [client 34.122.144.100:54691] [client 34.122.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "af2QueB0GbUWhxgzX9X4tAAAAI0"]
[Fri May 08 15:33:20.320064 2026] [:error] [pid 61355:tid 61372] [client 4.193.137.131:14531] [client 4.193.137.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.193.137.131, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "af2RwPkhJTi30CBXmMlfyQAAAYs"]
[Fri May 08 15:33:24.376817 2026] [:error] [pid 61356:tid 61393] [client 4.193.137.131:14421] [client 4.193.137.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.193.137.131, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "af2RxIx3vpB8oWhUq2M2UwAAAcU"]
[Fri May 08 15:33:27.713730 2026] [autoindex:error] [pid 61356:tid 61390] [client 4.193.137.131:14544] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri May 08 15:33:28.310561 2026] [:error] [pid 61356:tid 61397] [client 4.193.137.131:14865] [client 4.193.137.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "af2RyIx3vpB8oWhUq2M2bgAAAck"]
[Fri May 08 15:33:29.485382 2026] [autoindex:error] [pid 51009:tid 51078] [client 4.193.137.131:15297] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri May 08 15:33:29.578021 2026] [autoindex:error] [pid 51009:tid 51081] [client 4.193.137.131:15297] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri May 08 15:33:30.252268 2026] [autoindex:error] [pid 61317:tid 61333] [client 4.193.137.131:15307] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri May 08 15:33:30.345578 2026] [autoindex:error] [pid 61317:tid 61329] [client 4.193.137.131:15307] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri May 08 18:55:28.028525 2026] [:error] [pid 51113:tid 51125] [client 106.211.98.69:4171] [client 106.211.98.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.211.98.69, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "af3BIEQfs7sWtqkpQIduugAAAMo"]
[Sat May 09 01:27:30.322903 2026] [:error] [pid 34318:tid 34327] [client 44.242.136.6:54792] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "af4dAsr3guirgJiKhzACygAAAQc"]
[Sat May 09 01:27:31.828954 2026] [:error] [pid 61356:tid 61410] [client 44.242.136.6:54844] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env"] [unique_id "af4dA4x3vpB8oWhUq2MkugAAAdY"]
[Sat May 09 01:27:56.065632 2026] [:error] [pid 61317:tid 61331] [client 44.242.136.6:39240] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.perthactive.com.au|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.perthactive.com.au"] [uri "/phpinfo.php.bak"] [unique_id "af4dHM-fFk_CedOCOYsKLgAAAUs"]
[Sat May 09 01:27:56.247795 2026] [:error] [pid 61317:tid 61334] [client 44.242.136.6:39240] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.perthactive.com.au|F|2"] [data ".php.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.perthactive.com.au"] [uri "/phpinfo.php.old"] [unique_id "af4dHM-fFk_CedOCOYsKMQAAAU4"]
[Sat May 09 01:27:57.187921 2026] [:error] [pid 51008:tid 51071] [client 44.242.136.6:39256] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.perthactive.com.au|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.perthactive.com.au"] [uri "/info.php.bak"] [unique_id "af4dHXB58C2Y1tgLtuLZagAAAFY"]
[Sat May 09 01:46:24.532028 2026] [:error] [pid 61355:tid 61366] [client 13.113.204.210:35956] [client 13.113.204.210] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "af4hcPkhJTi30CBXmMk-VQAAAYU"]
[Sat May 09 01:46:25.874526 2026] [:error] [pid 61355:tid 61385] [client 13.113.204.210:35992] [client 13.113.204.210] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env"] [unique_id "af4hcfkhJTi30CBXmMk-XwAAAZg"]
[Sat May 09 01:46:50.539682 2026] [:error] [pid 51009:tid 51092] [client 13.113.204.210:55084] [client 13.113.204.210] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/phpinfo.php.bak"] [unique_id "af4hiuB0GbUWhxgzX9WZgQAAAJA"]
[Sat May 09 01:46:50.702313 2026] [:error] [pid 51009:tid 51095] [client 13.113.204.210:55084] [client 13.113.204.210] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".php.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/phpinfo.php.old"] [unique_id "af4hiuB0GbUWhxgzX9WZggAAAJM"]
[Sat May 09 01:46:51.747870 2026] [:error] [pid 61356:tid 61407] [client 13.113.204.210:58258] [client 13.113.204.210] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||perthactive.com.au|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/info.php.bak"] [unique_id "af4hi4x3vpB8oWhUq2MwPgAAAdM"]
[Sat May 09 03:24:22.374176 2026] [:error] [pid 61317:tid 61323] [client 35.201.41.26:49956] [client 35.201.41.26] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "af44Zs-fFk_CedOCOYsp9QAAAUM"]
[Sat May 09 04:00:20.279503 2026] [:error] [pid 9663:tid 9671] [client 45.130.83.111:52711] [client 45.130.83.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.83.111, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "af5A1JcWIu01SCxbjwupvgAAAQU"]
[Sat May 09 04:19:01.724676 2026] [:error] [pid 9293:tid 9306] [client 44.242.136.6:50024] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "af5FNZR__qEzV5O6Z2OVcAAAAMk"]
[Sat May 09 04:19:03.230435 2026] [:error] [pid 9293:tid 9300] [client 44.242.136.6:50054] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env"] [unique_id "af5FN5R__qEzV5O6Z2OVdQAAAMM"]
[Sat May 09 04:19:03.953645 2026] [:error] [pid 9187:tid 9263] [client 44.242.136.6:38166] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.local"] [unique_id "af5FNxC7An6gkXsRsaHCgQAAAIo"]
[Sat May 09 04:19:04.672151 2026] [:error] [pid 9293:tid 9308] [client 44.242.136.6:38182] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.production"] [unique_id "af5FOJR__qEzV5O6Z2OVewAAAMs"]
[Sat May 09 04:19:05.392952 2026] [:error] [pid 9293:tid 9315] [client 44.242.136.6:38198] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.staging"] [unique_id "af5FOZR__qEzV5O6Z2OVgQAAANI"]
[Sat May 09 04:19:06.116531 2026] [:error] [pid 9187:tid 9272] [client 44.242.136.6:38206] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.development"] [unique_id "af5FOhC7An6gkXsRsaHChAAAAJM"]
[Sat May 09 04:19:06.839630 2026] [:error] [pid 9184:tid 9210] [client 44.242.136.6:38234] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.test"] [unique_id "af5FOojfODqb_i0Fm99OIAAAAA0"]
[Sat May 09 04:19:07.562687 2026] [:error] [pid 9187:tid 9264] [client 44.242.136.6:38252] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.remote"] [unique_id "af5FOxC7An6gkXsRsaHCiAAAAIs"]
[Sat May 09 04:19:08.284481 2026] [:error] [pid 9663:tid 9671] [client 44.242.136.6:38274] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.bak"] [unique_id "af5FPJcWIu01SCxbjwuxuAAAAQU"]
[Sat May 09 04:19:09.005838 2026] [:error] [pid 9187:tid 9259] [client 44.242.136.6:38288] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.backup"] [unique_id "af5FPRC7An6gkXsRsaHCjAAAAIY"]
[Sat May 09 04:19:09.728523 2026] [:error] [pid 9663:tid 9678] [client 44.242.136.6:38294] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.save"] [unique_id "af5FPZcWIu01SCxbjwuxuwAAAQw"]
[Sat May 09 04:19:10.449043 2026] [:error] [pid 9184:tid 9220] [client 44.242.136.6:38308] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.old"] [unique_id "af5FPojfODqb_i0Fm99OIgAAABc"]
[Sat May 09 04:19:11.171331 2026] [:error] [pid 9760:tid 9777] [client 44.242.136.6:38322] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.sample"] [unique_id "af5FP2IkCp-C_fh0s7L4GAAAAUs"]
[Sat May 09 04:19:11.891315 2026] [:error] [pid 9184:tid 9198] [client 44.242.136.6:38340] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.example"] [unique_id "af5FP4jfODqb_i0Fm99OJgAAAAE"]
[Sat May 09 04:19:12.614050 2026] [:error] [pid 9186:tid 9227] [client 44.242.136.6:38358] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.dev"] [unique_id "af5FQBW4eFOEw1mKOgJlJgAAAEE"]
[Sat May 09 04:19:13.334709 2026] [:error] [pid 9920:tid 9927] [client 44.242.136.6:38372] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.prod"] [unique_id "af5FQUxitGYhlzgZb5Y_fQAAAcU"]
[Sat May 09 04:19:14.059333 2026] [:error] [pid 9186:tid 9228] [client 44.242.136.6:47484] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.stage"] [unique_id "af5FQhW4eFOEw1mKOgJlKgAAAEI"]
[Sat May 09 04:19:14.780343 2026] [:error] [pid 9920:tid 9945] [client 44.242.136.6:47506] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.ci"] [unique_id "af5FQkxitGYhlzgZb5Y_jwAAAdc"]
[Sat May 09 04:19:15.501855 2026] [:error] [pid 9184:tid 9211] [client 44.242.136.6:47522] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.docker"] [unique_id "af5FQ4jfODqb_i0Fm99OKgAAAA4"]
[Sat May 09 04:19:16.223578 2026] [:error] [pid 9187:tid 9259] [client 44.242.136.6:47528] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.live"] [unique_id "af5FRBC7An6gkXsRsaHCkQAAAIY"]
[Sat May 09 04:19:16.943391 2026] [:error] [pid 9920:tid 9922] [client 44.242.136.6:47544] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.preprod"] [unique_id "af5FRExitGYhlzgZb5Y_pwAAAcA"]
[Sat May 09 04:19:17.669736 2026] [:error] [pid 9920:tid 9931] [client 44.242.136.6:47566] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.uat"] [unique_id "af5FRUxitGYhlzgZb5Y_rQAAAck"]
[Sat May 09 04:19:18.392315 2026] [:error] [pid 9833:tid 9860] [client 44.242.136.6:47590] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.dist"] [unique_id "af5FRiM9JmxIS0KGZUAiZwAAAZY"]
[Sat May 09 04:19:19.113570 2026] [:error] [pid 9833:tid 9847] [client 44.242.136.6:47612] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.swp"] [unique_id "af5FRyM9JmxIS0KGZUAibwAAAYk"]
[Sat May 09 04:19:19.834500 2026] [:error] [pid 9187:tid 9263] [client 44.242.136.6:47634] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env~"] [unique_id "af5FRxC7An6gkXsRsaHCkgAAAIo"]
[Sat May 09 04:19:20.563943 2026] [:error] [pid 9760:tid 9780] [client 44.242.136.6:47658] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env1"] [unique_id "af5FSGIkCp-C_fh0s7L4IQAAAU4"]
[Sat May 09 04:19:21.285442 2026] [:error] [pid 9184:tid 9216] [client 44.242.136.6:47688] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env2"] [unique_id "af5FSYjfODqb_i0Fm99OLQAAABM"]
[Sat May 09 04:19:22.007912 2026] [:error] [pid 9186:tid 9246] [client 44.242.136.6:47704] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env_copy"] [unique_id "af5FShW4eFOEw1mKOgJlOgAAAFQ"]
[Sat May 09 04:19:22.736071 2026] [:error] [pid 9293:tid 9310] [client 44.242.136.6:47726] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.txt"] [unique_id "af5FSpR__qEzV5O6Z2OVjAAAAM0"]
[Sat May 09 04:19:23.457521 2026] [:error] [pid 9187:tid 9267] [client 44.242.136.6:47746] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.json"] [unique_id "af5FSxC7An6gkXsRsaHClgAAAI4"]
[Sat May 09 04:19:24.182062 2026] [:error] [pid 9293:tid 9299] [client 44.242.136.6:33650] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.yaml"] [unique_id "af5FTJR__qEzV5O6Z2OVkwAAAMI"]
[Sat May 09 04:19:24.906803 2026] [:error] [pid 9293:tid 9303] [client 44.242.136.6:33670] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.yml"] [unique_id "af5FTJR__qEzV5O6Z2OVlQAAAMY"]
[Sat May 09 04:19:25.632041 2026] [:error] [pid 9187:tid 9257] [client 44.242.136.6:33692] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/app/.env"] [unique_id "af5FTRC7An6gkXsRsaHCpgAAAIQ"]
[Sat May 09 04:19:26.359842 2026] [:error] [pid 9187:tid 9272] [client 44.242.136.6:33710] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/apps/.env"] [unique_id "af5FThC7An6gkXsRsaHCrAAAAJM"]
[Sat May 09 04:19:27.085436 2026] [:error] [pid 9184:tid 9215] [client 44.242.136.6:33740] [client 44.242.136.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/api/.env"] [unique_id "af5FT4jfODqb_i0Fm99OLwAAABI"]
[Sat May 09 04:22:06.779086 2026] [:error] [pid 9187:tid 9270] [client 20.220.146.147:46768] [client 20.220.146.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.146.147, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "af5F7hC7An6gkXsRsaHEAAAAAJE"]
[Sat May 09 04:22:15.323205 2026] [:error] [pid 9187:tid 9272] [client 20.220.146.147:64452] [client 20.220.146.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.220.146.147, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "af5F9xC7An6gkXsRsaHEJgAAAJM"]
[Sat May 09 04:22:22.594800 2026] [autoindex:error] [pid 9293:tid 9303] [client 20.220.146.147:43174] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 09 04:22:22.805585 2026] [autoindex:error] [pid 9293:tid 9299] [client 20.220.146.147:43174] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 09 04:22:24.988743 2026] [autoindex:error] [pid 9920:tid 9942] [client 20.220.146.147:50274] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 09 04:22:25.202538 2026] [:error] [pid 9920:tid 9923] [client 20.220.146.147:50274] [client 20.220.146.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "af5GAUxitGYhlzgZb5ZAwwAAAcE"]
[Sat May 09 04:22:27.774444 2026] [autoindex:error] [pid 9184:tid 9216] [client 20.220.146.147:58336] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 09 04:22:27.984563 2026] [autoindex:error] [pid 9184:tid 9217] [client 20.220.146.147:58336] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 09 04:22:29.494014 2026] [autoindex:error] [pid 9186:tid 9247] [client 20.220.146.147:55307] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 09 04:22:29.710723 2026] [autoindex:error] [pid 9186:tid 9248] [client 20.220.146.147:55307] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 09 10:19:46.065576 2026] [:error] [pid 9184:tid 9200] [client 20.151.175.120:23869] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wk/index.php"] [unique_id "af6ZwojfODqb_i0Fm992cwAAAAM"]
[Sat May 09 10:19:46.897875 2026] [:error] [pid 9833:tid 9838] [client 20.151.175.120:23836] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wk/index.php"] [unique_id "af6ZwiM9JmxIS0KGZUBZJwAAAYA"]
[Sat May 09 10:19:48.123600 2026] [:error] [pid 9920:tid 9946] [client 20.151.175.120:23824] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wk/index.php"] [unique_id "af6ZxExitGYhlzgZb5agLAAAAdg"]
[Sat May 09 10:19:48.980468 2026] [:error] [pid 9920:tid 9930] [client 20.151.175.120:23864] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wk/index.php"] [unique_id "af6ZxExitGYhlzgZb5agMgAAAcg"]
[Sat May 09 13:07:07.716958 2026] [:error] [pid 9663:tid 9689] [client 8.229.43.221:63208] [client 8.229.43.221] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "af7A-5cWIu01SCxbjwsfSgAAARc"]
[Sat May 09 13:07:08.638780 2026] [:error] [pid 9663:tid 9681] [client 8.229.43.221:61471] [client 8.229.43.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.229.43.221, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "af7A_JcWIu01SCxbjwsfUAAAAQ8"]
[Sat May 09 13:59:41.356151 2026] [:error] [pid 9663:tid 9683] [client 182.8.161.222:9875] [client 182.8.161.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.8.161.222, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "af7NTZcWIu01SCxbjwsn7AAAARE"]
[Sat May 09 17:01:06.857991 2026] [:error] [pid 9663:tid 9666] [client 197.26.112.20:53984] [client 197.26.112.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.26.112.20, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "af730pcWIu01SCxbjwtE1AAAAQA"]
[Sun May 10 01:45:04.525543 2026] [:error] [pid 55191:tid 55289] [client 34.130.64.219:47796] [client 34.130.64.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "af9yoPMcqx1kfQsw7c48WwAAAIw"]
[Sun May 10 03:55:42.336588 2026] [:error] [pid 62802:tid 62858] [client 104.234.53.160:41853] [client 104.234.53.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.160, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "af-RPqt9wnaRe0v-Mka11AAAAFU"]
[Mon May 11 00:42:48.901761 2026] [:error] [pid 16038:tid 16073] [client 94.181.229.245:51122] [client 94.181.229.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "agC1iE4hf5Tcsfa2scJuuQAAAYU"]
[Mon May 11 00:42:48.904376 2026] [:error] [pid 16037:tid 16047] [client 94.181.229.245:51098] [client 94.181.229.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production"] [unique_id "agC1iHzjLQfyYTkAdSSUigAAAAY"]
[Mon May 11 00:42:48.930818 2026] [:error] [pid 9842:tid 9855] [client 94.181.229.245:51136] [client 94.181.229.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "agC1iEKCvgYKKAjiZbJlhwAAAQo"], referer: https://www.google.com/
[Mon May 11 00:42:48.959718 2026] [:error] [pid 9842:tid 9851] [client 94.181.229.245:51150] [client 94.181.229.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local"] [unique_id "agC1iEKCvgYKKAjiZbJliAAAAQY"]
[Mon May 11 03:16:22.486403 2026] [:error] [pid 37030:tid 37055] [client 158.173.67.26:52053] [client 158.173.67.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "agDZhprBzfXWwKkDkdbiKAAAANc"]
[Mon May 11 03:29:39.129477 2026] [:error] [pid 16037:tid 16065] [client 185.169.4.152:52475] [client 185.169.4.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/"] [unique_id "agDco3zjLQfyYTkAdSSzmgAAABg"], referer: binance.com
[Mon May 11 05:21:32.896728 2026] [autoindex:error] [pid 65260:tid 65311] [client 213.136.67.3:55832] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon May 11 08:04:06.030657 2026] [:error] [pid 35052:tid 35071] [client 34.32.45.216:42094] [client 34.32.45.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agEc9uHjpNNnFJrMXu2TcgAAAVA"]
[Mon May 11 08:36:08.221448 2026] [:error] [pid 9335:tid 9358] [client 35.204.205.120:34434] [client 35.204.205.120] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agEkeHmXqumINT8bKRE5_gAAARU"]
[Mon May 11 09:14:19.799755 2026] [:error] [pid 65366:tid 65384] [client 35.203.118.91:41100] [client 35.203.118.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "agEta6hVGdYzapDtv-EKjQAAAM8"]
[Mon May 11 13:42:27.267580 2026] [:error] [pid 65366:tid 65371] [client 34.182.214.178:42350] [client 34.182.214.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agFsQ6hVGdYzapDtv-E0AgAAAMM"]
[Mon May 11 13:49:35.533930 2026] [:error] [pid 9335:tid 9345] [client 34.116.206.179:59974] [client 34.116.206.179] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agFt73mXqumINT8bKRF5KQAAAQg"]
[Mon May 11 14:14:52.277473 2026] [:error] [pid 58750:tid 58771] [client 34.78.85.13:33068] [client 34.78.85.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agFz3DBVaNG3wJtPBU-H2gAAAVM"]
[Mon May 11 14:20:16.599718 2026] [:error] [pid 58616:tid 58656] [client 34.39.106.46:59168] [client 34.39.106.46] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agF1INnsbeF5ioCAecjMlAAAAMo"]
[Mon May 11 15:11:56.187536 2026] [:error] [pid 58615:tid 58620] [client 34.154.205.224:60358] [client 34.154.205.224] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agGBPFK28yH055J8TSrBmgAAAAE"]
[Mon May 11 15:31:30.784105 2026] [:error] [pid 4645:tid 4666] [client 24.77.77.1:5772] [client 24.77.77.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.77.77.1, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "agGF0ny4dxn8-Cx5vOWH5gAAAFI"]
[Tue May 12 11:58:45.829169 2026] [:error] [pid 39957:tid 40016] [client 182.10.129.37:27976] [client 182.10.129.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.10.129.37, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "agKldeAfHHyq0DBh5BItHwAAAFg"]
[Wed May 13 01:17:17.404151 2026] [autoindex:error] [pid 39956:tid 39980] [client 141.98.11.120:63877] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed May 13 06:20:14.897360 2026] [:error] [pid 23887:tid 23910] [client 91.92.241.188:35754] [client 91.92.241.188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "agOnntSKmvZJZkXBFDDxnAAAAM8"]
[Wed May 13 08:28:31.343900 2026] [autoindex:error] [pid 23887:tid 23906] [client 20.220.148.253:38631] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/post-comments-form/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 08:28:31.558041 2026] [autoindex:error] [pid 23887:tid 23908] [client 20.220.148.253:38631] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 08:28:45.288394 2026] [:error] [pid 23887:tid 23897] [client 20.220.148.253:19661] [client 20.220.148.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "agPFvdSKmvZJZkXBFDAXZwAAAMI"]
[Wed May 13 08:28:50.271432 2026] [autoindex:error] [pid 23787:tid 23872] [client 20.220.148.253:24077] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 08:28:52.929577 2026] [autoindex:error] [pid 23887:tid 23909] [client 20.220.148.253:43558] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 08:28:53.143384 2026] [autoindex:error] [pid 23887:tid 23904] [client 20.220.148.253:43558] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 08:29:08.448359 2026] [autoindex:error] [pid 3259:tid 3285] [client 20.220.148.253:17767] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 08:29:13.061392 2026] [autoindex:error] [pid 23782:tid 23831] [client 20.220.148.253:44051] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 08:29:21.925488 2026] [autoindex:error] [pid 23887:tid 23915] [client 20.220.148.253:13220] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 08:29:41.849352 2026] [autoindex:error] [pid 23887:tid 23917] [client 20.220.148.253:16287] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 08:29:46.875644 2026] [autoindex:error] [pid 23787:tid 23849] [client 20.220.148.253:22067] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 08:29:49.220146 2026] [autoindex:error] [pid 23887:tid 23903] [client 20.220.148.253:22573] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 08:29:54.766533 2026] [:error] [pid 23887:tid 23906] [client 20.220.148.253:58524] [client 20.220.148.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "agPGAtSKmvZJZkXBFDAXwgAAAMs"]
[Wed May 13 08:30:04.368924 2026] [autoindex:error] [pid 23787:tid 23866] [client 20.220.148.253:30664] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 12:02:58.312872 2026] [:error] [pid 23787:tid 23863] [client 45.3.62.182:53655] [client 45.3.62.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.svn/wc.db"] [unique_id "agP38h1cs5wE7VT6wirjqwAAAI8"]
[Wed May 13 20:48:40.243766 2026] [autoindex:error] [pid 11406:tid 11480] [client 194.163.140.214:57551] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu May 14 00:02:56.413153 2026] [:error] [pid 12337:tid 12365] [client 137.220.224.53:12375] [client 137.220.224.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.220.224.53, incrementing brute counter"] [hostname "www.perthactive.com.au"] [uri "/wp-login.php"] [unique_id "agSgsA9W0E4_X4qzYUF1UAAAABc"], referer: https://search.yahoo.com/
[Thu May 14 01:45:55.606223 2026] [:error] [pid 12338:tid 12381] [client 157.15.40.76:51251] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/txets.php"] [unique_id "agS408UJ87l42ffPr4wvkQAAAEw"]
[Thu May 14 01:45:57.387326 2026] [:error] [pid 17873:tid 17877] [client 157.15.40.76:51321] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/txets.php"] [unique_id "agS41fEqBQQrkyEyu_ouMQAAAQI"]
[Thu May 14 01:46:00.548986 2026] [:error] [pid 12340:tid 12407] [client 157.15.40.76:51397] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/txets.php"] [unique_id "agS42MrxSPfvmN7BQjK3BgAAAIs"]
[Thu May 14 01:46:06.822473 2026] [:error] [pid 12426:tid 12452] [client 157.15.40.76:51603] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/txets.php"] [unique_id "agS43rPw24RslX3LIcZohgAAANg"]
[Thu May 14 01:46:10.483293 2026] [:error] [pid 12338:tid 12392] [client 157.15.40.76:51841] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/schallfuns.php"] [unique_id "agS44sUJ87l42ffPr4wvsgAAAFc"]
[Thu May 14 01:46:13.749162 2026] [:error] [pid 17873:tid 17894] [client 157.15.40.76:52183] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/postnews.php"] [unique_id "agS45fEqBQQrkyEyu_oubwAAARM"]
[Thu May 14 01:46:14.420661 2026] [:error] [pid 12426:tid 12441] [client 157.15.40.76:52406] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/postnews.php"] [unique_id "agS45rPw24RslX3LIcZomAAAAM0"]
[Thu May 14 01:46:15.186081 2026] [:error] [pid 12337:tid 12344] [client 157.15.40.76:52455] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/postnews.php"] [unique_id "agS45w9W0E4_X4qzYUGCzQAAAAI"]
[Thu May 14 01:46:16.224932 2026] [:error] [pid 17873:tid 17888] [client 157.15.40.76:52508] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/postnews.php"] [unique_id "agS46PEqBQQrkyEyu_oudQAAAQ0"]
[Thu May 14 02:36:45.890366 2026] [:error] [pid 12426:tid 12446] [client 208.84.101.231:30756] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/app/.env"] [unique_id "agTEvbPw24RslX3LIcZyhgAAANI"]
[Thu May 14 02:36:45.897613 2026] [:error] [pid 12337:tid 12361] [client 208.84.101.231:30832] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "agTEvQ9W0E4_X4qzYUGJkgAAABM"]
[Thu May 14 02:36:45.898720 2026] [:error] [pid 12426:tid 12436] [client 208.84.101.231:30774] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/backend/.env"] [unique_id "agTEvbPw24RslX3LIcZyiAAAAMg"]
[Thu May 14 02:36:45.899202 2026] [:error] [pid 12340:tid 12403] [client 208.84.101.231:30770] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.env"] [unique_id "agTEvcrxSPfvmN7BQjLIwgAAAIc"]
[Thu May 14 02:36:45.921533 2026] [:error] [pid 12340:tid 12410] [client 208.84.101.231:30746] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local"] [unique_id "agTEvcrxSPfvmN7BQjLIxgAAAI4"]
[Thu May 14 02:36:45.921608 2026] [:error] [pid 12340:tid 12416] [client 208.84.101.231:30752] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production"] [unique_id "agTEvcrxSPfvmN7BQjLIxQAAAJQ"]
[Thu May 14 02:36:50.764373 2026] [:error] [pid 17873:tid 17887] [client 208.84.101.231:31036] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.bak"] [unique_id "agTEwvEqBQQrkyEyu_o5VAAAAQw"]
[Thu May 14 02:36:50.764709 2026] [:error] [pid 12337:tid 12345] [client 208.84.101.231:31014] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/refs/heads/master"] [unique_id "agTEwg9W0E4_X4qzYUGJkwAAAAM"]
[Thu May 14 02:36:50.764706 2026] [:error] [pid 17873:tid 17880] [client 208.84.101.231:31026] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/logs/HEAD"] [unique_id "agTEwvEqBQQrkyEyu_o5VQAAAQU"]
[Thu May 14 02:36:50.764895 2026] [:error] [pid 17873:tid 17896] [client 208.84.101.231:30994] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/FETCH_HEAD"] [unique_id "agTEwvEqBQQrkyEyu_o5VgAAARQ"]
[Thu May 14 02:36:50.765257 2026] [:error] [pid 17873:tid 17886] [client 208.84.101.231:31008] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/refs/heads/main"] [unique_id "agTEwvEqBQQrkyEyu_o5VwAAAQs"]
[Thu May 14 02:36:50.856399 2026] [:error] [pid 12340:tid 12398] [client 208.84.101.231:31044] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.old"] [unique_id "agTEwsrxSPfvmN7BQjLI0gAAAII"]
[Thu May 14 02:36:50.860460 2026] [:error] [pid 17873:tid 17892] [client 208.84.101.231:30990] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "agTEwvEqBQQrkyEyu_o5WAAAARE"]
[Thu May 14 02:36:50.861055 2026] [:error] [pid 12338:tid 12383] [client 208.84.101.231:30988] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/HEAD"] [unique_id "agTEwsUJ87l42ffPr4w3VwAAAE4"]
[Thu May 14 02:36:50.861329 2026] [:error] [pid 17873:tid 17876] [client 208.84.101.231:30976] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production.copy"] [unique_id "agTEwvEqBQQrkyEyu_o5WQAAAQE"]
[Thu May 14 02:36:50.874849 2026] [:error] [pid 12340:tid 12409] [client 208.84.101.231:31214] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production~"] [unique_id "agTEwsrxSPfvmN7BQjLI0wAAAI0"]
[Thu May 14 02:36:51.016780 2026] [:error] [pid 12340:tid 12403] [client 208.84.101.231:31096] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.orig"] [unique_id "agTEw8rxSPfvmN7BQjLI1QAAAIc"]
[Thu May 14 02:36:51.019595 2026] [:error] [pid 12340:tid 12418] [client 208.84.101.231:31104] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.copy"] [unique_id "agTEw8rxSPfvmN7BQjLI1gAAAJY"]
[Thu May 14 02:36:51.019625 2026] [:error] [pid 12340:tid 12400] [client 208.84.101.231:31206] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production.backup"] [unique_id "agTEw8rxSPfvmN7BQjLI1wAAAIQ"]
[Thu May 14 02:36:51.020361 2026] [:error] [pid 12340:tid 12397] [client 208.84.101.231:31188] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production.bak"] [unique_id "agTEw8rxSPfvmN7BQjLI2AAAAIE"]
[Thu May 14 02:36:51.022551 2026] [:error] [pid 12340:tid 12413] [client 208.84.101.231:31212] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production.save"] [unique_id "agTEw8rxSPfvmN7BQjLI2QAAAJE"]
[Thu May 14 02:36:51.023090 2026] [:error] [pid 12340:tid 12411] [client 208.84.101.231:31058] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.backup"] [unique_id "agTEw8rxSPfvmN7BQjLI2gAAAI8"]
[Thu May 14 02:36:51.023100 2026] [:error] [pid 12340:tid 12412] [client 208.84.101.231:31084] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.swp"] [unique_id "agTEw8rxSPfvmN7BQjLI2wAAAJA"]
[Thu May 14 02:36:51.023750 2026] [:error] [pid 12340:tid 12416] [client 208.84.101.231:31068] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.save"] [unique_id "agTEw8rxSPfvmN7BQjLI3AAAAJQ"]
[Thu May 14 02:36:51.025230 2026] [:error] [pid 12340:tid 12401] [client 208.84.101.231:31172] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local.orig"] [unique_id "agTEw8rxSPfvmN7BQjLI3QAAAIU"]
[Thu May 14 02:36:51.025537 2026] [:error] [pid 12340:tid 12417] [client 208.84.101.231:31186] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local.copy"] [unique_id "agTEw8rxSPfvmN7BQjLI3gAAAJU"]
[Thu May 14 02:36:51.026181 2026] [:error] [pid 12340:tid 12405] [client 208.84.101.231:31156] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local.swp"] [unique_id "agTEw8rxSPfvmN7BQjLI3wAAAIk"]
[Thu May 14 02:36:51.026417 2026] [:error] [pid 12337:tid 12365] [client 208.84.101.231:31148] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local~"] [unique_id "agTEww9W0E4_X4qzYUGJlAAAABc"]
[Thu May 14 02:36:51.026743 2026] [:error] [pid 17873:tid 17888] [client 208.84.101.231:31070] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env~"] [unique_id "agTEw_EqBQQrkyEyu_o5WgAAAQ0"]
[Thu May 14 02:36:51.028630 2026] [:error] [pid 12340:tid 12415] [client 208.84.101.231:31128] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local.backup"] [unique_id "agTEw8rxSPfvmN7BQjLI4AAAAJM"]
[Thu May 14 02:36:51.028922 2026] [:error] [pid 12340:tid 12399] [client 208.84.101.231:31232] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production.orig"] [unique_id "agTEw8rxSPfvmN7BQjLI4QAAAIM"]
[Thu May 14 02:36:51.029382 2026] [:error] [pid 17873:tid 17899] [client 208.84.101.231:31144] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local.save"] [unique_id "agTEw_EqBQQrkyEyu_o5WwAAARU"]
[Thu May 14 02:36:51.029539 2026] [:error] [pid 12340:tid 12407] [client 208.84.101.231:31126] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local.old"] [unique_id "agTEw8rxSPfvmN7BQjLI4gAAAIs"]
[Thu May 14 02:36:51.029639 2026] [:error] [pid 12340:tid 12404] [client 208.84.101.231:31222] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production.swp"] [unique_id "agTEw8rxSPfvmN7BQjLI4wAAAIg"]
[Thu May 14 02:36:51.034811 2026] [:error] [pid 12340:tid 12402] [client 208.84.101.231:31120] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local.bak"] [unique_id "agTEw8rxSPfvmN7BQjLI5AAAAIY"]
[Thu May 14 02:36:51.036942 2026] [:error] [pid 12340:tid 12410] [client 208.84.101.231:31192] [client 208.84.101.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production.old"] [unique_id "agTEw8rxSPfvmN7BQjLI5QAAAI4"]
[Thu May 14 02:40:43.363770 2026] [:error] [pid 12426:tid 12439] [client 80.76.160.26:54268] [client 80.76.160.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.76.160.26, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "agTFq7Pw24RslX3LIcZy9QAAAMs"]
[Thu May 14 16:23:17.007743 2026] [:error] [pid 11581:tid 11605] [client 36.37.209.184:50717] [client 36.37.209.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "agWGdf0vF48FbzpvQMXSAAAAAAg"]
[Fri May 15 07:32:07.849693 2026] [:error] [pid 50531:tid 50540] [client 20.55.47.18:1590] [client 20.55.47.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.55.47.18, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/wp/xmlrpc.php"] [unique_id "agZbdx3WbFwE6voqGzq5aQAAAQc"]
[Fri May 15 08:46:15.535309 2026] [:error] [pid 51234:tid 51240] [client 34.97.74.167:43876] [client 34.97.74.167] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agZs1972N9CbeiqcqgO-OgAAAUQ"]
[Fri May 15 10:07:24.965983 2026] [:error] [pid 1190:tid 1259] [client 34.179.215.63:37236] [client 34.179.215.63] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agZ_3NqiXrD7hne4gFbKfQAAAIc"]
[Fri May 15 10:44:22.547409 2026] [:error] [pid 1188:tid 1213] [client 34.96.188.205:56282] [client 34.96.188.205] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agaIhtY68iW8yuNkNzP00AAAABA"]
[Fri May 15 12:17:19.804464 2026] [:error] [pid 50531:tid 50534] [client 8.231.66.233:36304] [client 8.231.66.233] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agaeTx3WbFwE6voqGzr1cAAAAQE"]
[Fri May 15 12:19:09.001354 2026] [autoindex:error] [pid 50531:tid 50548] [client 40.81.226.252:52884] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri May 15 12:42:58.988037 2026] [:error] [pid 9392:tid 9414] [client 34.150.187.186:40158] [client 34.150.187.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agakUtBWJIjH1U9zGfZ2zQAAARQ"]
[Fri May 15 12:43:01.841800 2026] [:error] [pid 9392:tid 9402] [client 34.150.187.186:52678] [client 34.150.187.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agakVdBWJIjH1U9zGfZ2zgAAAQg"]
[Fri May 15 13:10:12.920556 2026] [:error] [pid 9392:tid 9408] [client 34.97.157.104:49400] [client 34.97.157.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agaqtNBWJIjH1U9zGfaDxgAAAQ4"]
[Fri May 15 21:34:40.403964 2026] [:error] [pid 30272:tid 30288] [client 57.151.128.100:37017] [client 57.151.128.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.151.128.100, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/wp/xmlrpc.php"] [unique_id "agcg8Hvc_jSFaQ_7_wf57QAAAY4"]
[Fri May 15 22:09:10.715829 2026] [:error] [pid 9304:tid 9328] [client 20.196.213.250:5995] [client 20.196.213.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.196.213.250, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "agcpBtzcINh7UFIbVoGgLAAAABI"]
[Fri May 15 22:09:16.415557 2026] [:error] [pid 30272:tid 30292] [client 20.196.213.250:2123] [client 20.196.213.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.196.213.250, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "agcpDHvc_jSFaQ_7_wcAwAAAAZI"]
[Fri May 15 22:09:21.714675 2026] [autoindex:error] [pid 30240:tid 30266] [client 20.196.213.250:5970] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri May 15 22:09:23.042426 2026] [:error] [pid 30272:tid 30285] [client 20.196.213.250:2016] [client 20.196.213.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agcpE3vc_jSFaQ_7_wcAzQAAAYs"]
[Fri May 15 22:09:25.143279 2026] [autoindex:error] [pid 9307:tid 9370] [client 20.196.213.250:1374] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri May 15 22:09:25.289090 2026] [autoindex:error] [pid 9307:tid 9367] [client 20.196.213.250:1374] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri May 15 22:09:26.386454 2026] [autoindex:error] [pid 9307:tid 9379] [client 20.196.213.250:1373] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri May 15 22:09:26.534418 2026] [autoindex:error] [pid 9307:tid 9371] [client 20.196.213.250:1373] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 16 01:59:31.109496 2026] [:error] [pid 59392:tid 59412] [client 158.173.67.9:26989] [client 158.173.67.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.173.67.9, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "agdfAp3J5hQfH1d5JHoS6wAAAxE"]
[Sat May 16 05:53:23.792790 2026] [autoindex:error] [pid 5602:tid 5628] [client 95.111.235.131:51522] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat May 16 10:32:23.715288 2026] [:error] [pid 24979:tid 24982] [client 37.139.53.198:30801] [client 37.139.53.198] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "agfXN7vSFUQiwLaOL2piNQAAAME"]
[Sat May 16 10:32:26.306305 2026] [:error] [pid 62210:tid 62212] [client 45.132.76.32:49889] [client 45.132.76.32] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "agfXOsjHonCA4ORo40GwIwAAAkA"]
[Sat May 16 13:37:39.197198 2026] [:error] [pid 61463:tid 61486] [client 34.181.219.130:53036] [client 34.181.219.130] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "aggCozXdL1WU7nYXPmTlHwAAAdU"]
[Sat May 16 13:37:39.943144 2026] [:error] [pid 24867:tid 24903] [client 34.181.219.130:61965] [client 34.181.219.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.181.219.130, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "aggCoyDgFLCgyKq-zmYQhQAAABY"]
[Sun May 17 00:47:06.773381 2026] [:error] [pid 61361:tid 61383] [client 92.118.39.29:36354] [client 92.118.39.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "agifipZojzbt3jGziNmjBQAAAVQ"]
[Sun May 17 05:09:11.889569 2026] [:error] [pid 59062:tid 59137] [client 35.224.43.36:34128] [client 35.224.43.36] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agjc9z4V9GkVWmCFmGay7wAAAI4"]
[Sun May 17 05:26:18.086898 2026] [:error] [pid 59060:tid 59088] [client 157.15.40.86:52538] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/txets.php"] [unique_id "agjg-vvwvq3bndkPE4nA3QAAABM"]
[Sun May 17 05:26:18.361338 2026] [:error] [pid 59166:tid 59181] [client 157.15.40.86:52797] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/txets.php"] [unique_id "agjg-k_puQ1I47_0Urin6wAAAM0"]
[Sun May 17 05:26:18.644964 2026] [:error] [pid 36652:tid 36668] [client 157.15.40.86:52833] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/txets.php"] [unique_id "agjg-jZrzQadnZADvj8ElAAAAQ4"]
[Sun May 17 05:26:20.060463 2026] [:error] [pid 36652:tid 36673] [client 157.15.40.86:52946] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/txets.php"] [unique_id "agjg_DZrzQadnZADvj8EqgAAARM"]
[Sun May 17 05:26:20.338190 2026] [:error] [pid 36652:tid 36659] [client 157.15.40.86:52972] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/schallfuns.php"] [unique_id "agjg_DZrzQadnZADvj8ErQAAAQU"]
[Sun May 17 05:26:21.294985 2026] [:error] [pid 36652:tid 36669] [client 157.15.40.86:53080] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/postnews.php"] [unique_id "agjg_TZrzQadnZADvj8EuAAAAQ8"]
[Sun May 17 05:26:22.868084 2026] [:error] [pid 59166:tid 59171] [client 157.15.40.86:53105] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/postnews.php"] [unique_id "agjg_k_puQ1I47_0UrioBgAAAMM"]
[Sun May 17 05:26:26.561163 2026] [:error] [pid 59060:tid 59082] [client 157.15.40.86:53316] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/postnews.php"] [unique_id "agjhAvvwvq3bndkPE4nA8gAAAA0"]
[Sun May 17 05:26:27.289108 2026] [:error] [pid 59062:tid 59144] [client 157.15.40.86:53677] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/postnews.php"] [unique_id "agjhAz4V9GkVWmCFmGa0rwAAAJU"]
[Sun May 17 13:03:23.015707 2026] [:error] [pid 59060:tid 59084] [client 192.96.159.129:63713] [client 192.96.159.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "aglMG_vwvq3bndkPE4ndAwAAAA8"]
[Sun May 17 14:56:03.506993 2026] [:error] [pid 10835:tid 10876] [client 162.158.94.96:14248] [client 162.158.94.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "aglmg0k8lW0-dtknLl_8swAAAgM"]
[Sun May 17 17:59:11.538922 2026] [:error] [pid 36652:tid 36677] [client 103.253.27.67:64265] [client 103.253.27.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "agmRbzZrzQadnZADvj9UVQAAARc"]
[Sun May 17 17:59:12.666761 2026] [:error] [pid 17234:tid 17246] [client 103.253.27.67:64322] [client 103.253.27.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.vscode/sftp-config.json"] [unique_id "agmRcNJ4QOrYRCeDR2hSlgAAAUo"]
[Sun May 17 21:46:12.392420 2026] [:error] [pid 10834:tid 10866] [client 82.137.233.155:59023] [client 82.137.233.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.137.233.155, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "agnGpBISNQ_Nf83-Vpq1rwAAAdQ"]
[Sun May 17 21:56:12.398568 2026] [:error] [pid 59060:tid 59086] [client 136.111.103.81:55950] [client 136.111.103.81] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "agnI_Pvwvq3bndkPE4n4eAAAABE"]
[Sun May 17 21:56:13.540201 2026] [:error] [pid 59060:tid 59081] [client 136.111.103.81:62467] [client 136.111.103.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.103.81, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "agnI_fvwvq3bndkPE4n4egAAAAw"]
[Sun May 17 22:03:06.834886 2026] [:error] [pid 10784:tid 10801] [client 20.214.241.91:3854] [client 20.214.241.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.214.241.91, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "agnKmmBWRlKsFkSZGxBRMwAAAYI"]
[Sun May 17 22:03:12.621015 2026] [:error] [pid 59062:tid 59143] [client 20.214.241.91:3595] [client 20.214.241.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.214.241.91, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "agnKoD4V9GkVWmCFmGY2JAAAAJQ"]
[Sun May 17 22:03:17.906967 2026] [autoindex:error] [pid 10784:tid 10807] [client 20.214.241.91:3422] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 17 22:03:18.775197 2026] [:error] [pid 59062:tid 59128] [client 20.214.241.91:3589] [client 20.214.241.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agnKpj4V9GkVWmCFmGY2MAAAAIU"]
[Sun May 17 22:03:20.610714 2026] [autoindex:error] [pid 36652:tid 36661] [client 20.214.241.91:3599] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 17 22:03:20.773467 2026] [autoindex:error] [pid 36652:tid 36676] [client 20.214.241.91:3599] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 17 22:03:21.940633 2026] [autoindex:error] [pid 59166:tid 59172] [client 20.214.241.91:3624] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 17 22:03:22.097815 2026] [autoindex:error] [pid 59166:tid 59187] [client 20.214.241.91:3624] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 01:48:38.267054 2026] [:error] [pid 59062:tid 59130] [client 20.214.161.107:5511] [client 20.214.161.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.214.161.107, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "agn_dj4V9GkVWmCFmGZepAAAAIc"]
[Mon May 18 01:48:43.879365 2026] [:error] [pid 10834:tid 10850] [client 20.214.161.107:5348] [client 20.214.161.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.214.161.107, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "agn_exISNQ_Nf83-VprIsgAAAcQ"]
[Mon May 18 01:48:48.991967 2026] [autoindex:error] [pid 59062:tid 59124] [client 20.214.161.107:5550] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 01:48:49.940077 2026] [:error] [pid 59062:tid 59125] [client 20.214.161.107:5517] [client 20.214.161.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agn_gT4V9GkVWmCFmGZesQAAAII"]
[Mon May 18 01:48:51.785582 2026] [autoindex:error] [pid 10835:tid 10884] [client 20.214.161.107:5535] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 01:48:52.074691 2026] [autoindex:error] [pid 10835:tid 10896] [client 20.214.161.107:5535] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 01:48:53.303935 2026] [autoindex:error] [pid 59166:tid 59172] [client 20.214.161.107:5507] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 01:48:53.447492 2026] [autoindex:error] [pid 59166:tid 59178] [client 20.214.161.107:5507] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 02:49:51.357531 2026] [:error] [pid 10784:tid 10808] [client 20.214.161.107:4634] [client 20.214.161.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.214.161.107, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "agoNz2BWRlKsFkSZGxBjTwAAAYk"]
[Mon May 18 02:49:57.124395 2026] [:error] [pid 36652:tid 36672] [client 20.214.161.107:5045] [client 20.214.161.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.214.161.107, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "agoN1TZrzQadnZADvj9n9wAAARI"]
[Mon May 18 02:50:02.351505 2026] [autoindex:error] [pid 59166:tid 59191] [client 20.214.161.107:5053] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 02:50:03.240668 2026] [:error] [pid 10835:tid 10896] [client 20.214.161.107:4992] [client 20.214.161.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agoN20k8lW0-dtknLl9QLQAAAhc"]
[Mon May 18 02:50:05.071584 2026] [autoindex:error] [pid 59062:tid 59132] [client 20.214.161.107:5671] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 02:50:05.210225 2026] [autoindex:error] [pid 59062:tid 59133] [client 20.214.161.107:5671] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 02:50:06.254171 2026] [autoindex:error] [pid 59062:tid 59127] [client 20.214.161.107:5042] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 02:50:06.396590 2026] [autoindex:error] [pid 59062:tid 59137] [client 20.214.161.107:5042] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:00:21.444980 2026] [autoindex:error] [pid 20778:tid 20826] [client 172.202.0.52:63896] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:00:28.306739 2026] [autoindex:error] [pid 20779:tid 20865] [client 172.202.0.52:64548] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:00:28.500678 2026] [autoindex:error] [pid 20779:tid 20869] [client 172.202.0.52:64548] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:00:34.454808 2026] [:error] [pid 20884:tid 20889] [client 172.202.0.52:63252] [client 172.202.0.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "ago6gnv9K_lRldrJG3O0cgAAAMM"]
[Mon May 18 06:00:37.886722 2026] [autoindex:error] [pid 20777:tid 20804] [client 172.202.0.52:63871] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:00:38.746314 2026] [autoindex:error] [pid 20778:tid 20834] [client 172.202.0.52:63921] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:00:41.173453 2026] [autoindex:error] [pid 63115:tid 63138] [client 172.202.0.52:63234] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:00:48.850039 2026] [autoindex:error] [pid 20778:tid 20825] [client 172.202.0.52:64463] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:00:50.783502 2026] [autoindex:error] [pid 20884:tid 20886] [client 172.202.0.52:64570] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:01:13.987515 2026] [proxy_fcgi:error] [pid 63115:tid 63124] [client 172.202.0.52:63187] AH01071: Got error 'Primary script unknown'
[Mon May 18 06:01:14.173322 2026] [:error] [pid 63115:tid 63138] [client 172.202.0.52:63187] [client 172.202.0.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/shortcode/index.php"] [unique_id "ago6quz_ApFcYdejvGfvjQAAARU"]
[Mon May 18 06:01:16.400079 2026] [autoindex:error] [pid 20884:tid 20907] [client 172.202.0.52:63220] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:01:20.499353 2026] [autoindex:error] [pid 63115:tid 63122] [client 172.202.0.52:63203] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:01:22.062032 2026] [:error] [pid 20884:tid 20906] [client 172.202.0.52:64483] [client 172.202.0.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.202.0.52, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ago6snv9K_lRldrJG3O0jwAAANQ"]
[Mon May 18 06:01:26.556102 2026] [autoindex:error] [pid 20779:tid 20860] [client 172.202.0.52:64498] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:01:26.748291 2026] [autoindex:error] [pid 20779:tid 20859] [client 172.202.0.52:64498] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:01:33.995829 2026] [autoindex:error] [pid 20778:tid 20823] [client 172.202.0.52:64474] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:01:34.190769 2026] [proxy_fcgi:error] [pid 20778:tid 20820] [client 172.202.0.52:64474] AH01071: Got error 'PHP message: PHP Fatal error: Uncaught Error: Call to undefined function get_header() in /home/perthactivecom/public_html/wp-content/themes/twentytwenty/404.php:10\nStack trace:\n#0 {main}\n thrown in /home/perthactivecom/public_html/wp-content/themes/twentytwenty/404.php on line 10'
[Mon May 18 06:01:37.805946 2026] [autoindex:error] [pid 63115:tid 63136] [client 172.202.0.52:64564] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:01:37.998611 2026] [autoindex:error] [pid 63115:tid 63139] [client 172.202.0.52:64564] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:01:45.329172 2026] [autoindex:error] [pid 63115:tid 63133] [client 172.202.0.52:63869] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:01:45.520798 2026] [:error] [pid 63115:tid 63137] [client 172.202.0.52:63869] [client 172.202.0.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.202.0.52, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ago6yez_ApFcYdejvGfvwAAAARQ"]
[Mon May 18 06:01:53.401547 2026] [:error] [pid 20777:tid 20810] [client 172.202.0.52:63923] [client 172.202.0.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "ago60YHClf0EYFQBeRFGmwAAABg"]
[Mon May 18 06:01:56.841420 2026] [autoindex:error] [pid 20778:tid 20828] [client 172.202.0.52:64491] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:02:04.364765 2026] [:error] [pid 63115:tid 63124] [client 172.202.0.52:63194] [client 172.202.0.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "ago63Oz_ApFcYdejvGfwDQAAAQc"]
[Mon May 18 06:02:10.869453 2026] [autoindex:error] [pid 20779:tid 20868] [client 172.202.0.52:64509] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/php-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 06:02:11.057857 2026] [:error] [pid 20779:tid 20848] [client 172.202.0.52:64509] [client 172.202.0.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "ago64yF3Tl5ZGU-QyEDa0gAAAII"]
[Mon May 18 06:02:15.779709 2026] [:error] [pid 20884:tid 20896] [client 172.202.0.52:62764] [client 172.202.0.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "ago653v9K_lRldrJG3O09AAAAMo"]
[Mon May 18 06:02:16.540596 2026] [:error] [pid 63115:tid 63121] [client 172.202.0.52:62122] [client 172.202.0.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/admin.php"] [unique_id "ago66Oz_ApFcYdejvGfwGQAAAQQ"]
[Mon May 18 11:37:15.732010 2026] [:error] [pid 44046:tid 44053] [client 194.62.107.53:36025] [client 194.62.107.53] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "agqJa4YF4k2jfXJBXk3VbgAAAYU"]
[Mon May 18 13:07:34.714555 2026] [:error] [pid 36493:tid 36557] [client 104.28.153.63:31434] [client 104.28.153.63] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "agqelgynkzQB5nM668qeMgAAAQg"]
[Mon May 18 13:07:36.121572 2026] [:error] [pid 36579:tid 36592] [client 69.46.65.137:53584] [client 69.46.65.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "agqemF-aoZxBfgL5vDxXUQAAAEo"]
[Mon May 18 13:07:38.016498 2026] [:error] [pid 36491:tid 36497] [client 104.238.41.160:32480] [client 104.238.41.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "agqemk555B9CZb6D60mKrgAAAUI"]
[Mon May 18 13:07:39.669570 2026] [:error] [pid 36579:tid 36585] [client 104.238.42.244:22562] [client 104.238.42.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "agqem1-aoZxBfgL5vDxXVgAAAEM"]
[Mon May 18 13:07:40.177611 2026] [:error] [pid 36579:tid 36606] [client 104.28.153.63:30757] [client 104.28.153.63] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||perthactive.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "agqenF-aoZxBfgL5vDxXVwAAAFg"]
[Mon May 18 19:25:38.745093 2026] [:error] [pid 36579:tid 36602] [client 20.214.180.130:5693] [client 20.214.180.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.214.180.130, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "agr3Ml-aoZxBfgL5vDyL9AAAAFQ"]
[Mon May 18 19:25:44.898912 2026] [:error] [pid 43916:tid 43929] [client 20.214.180.130:4282] [client 20.214.180.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.214.180.130, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "agr3ONQC236p33zJJvnKLwAAAIU"]
[Mon May 18 19:25:50.646799 2026] [autoindex:error] [pid 36579:tid 36586] [client 20.214.180.130:2279] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 19:25:51.581091 2026] [:error] [pid 36491:tid 36496] [client 20.214.180.130:2270] [client 20.214.180.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agr3P0555B9CZb6D60nEmQAAAUE"]
[Mon May 18 19:25:53.705630 2026] [autoindex:error] [pid 36491:tid 36509] [client 20.214.180.130:2268] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 19:25:53.875680 2026] [autoindex:error] [pid 36491:tid 36512] [client 20.214.180.130:2268] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 19:25:55.018850 2026] [autoindex:error] [pid 36491:tid 36503] [client 20.214.180.130:5444] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 19:25:55.195815 2026] [autoindex:error] [pid 36491:tid 36498] [client 20.214.180.130:5444] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 18 20:33:23.924909 2026] [:error] [pid 44010:tid 44020] [client 223.223.129.214:58636] [client 223.223.129.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.223.129.214, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "agsHEzcFUuogD3-74-Z7rgAAAMg"]
[Mon May 18 22:07:52.379345 2026] [:error] [pid 36492:tid 36542] [client 8.228.4.49:59020] [client 8.228.4.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "agsdOGCVlogrkn9m2w79lQAAABQ"]
[Tue May 19 02:29:57.967699 2026] [:error] [pid 36493:tid 36550] [client 20.196.101.49:3325] [client 20.196.101.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.196.101.49, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "agtapQynkzQB5nM668robAAAAQE"]
[Tue May 19 02:30:03.631535 2026] [:error] [pid 36579:tid 36598] [client 20.196.101.49:3882] [client 20.196.101.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.196.101.49, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "agtaq1-aoZxBfgL5vDy5sAAAAFA"]
[Tue May 19 02:30:08.786741 2026] [autoindex:error] [pid 36491:tid 36517] [client 20.196.101.49:3034] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 02:30:09.672785 2026] [:error] [pid 36491:tid 36498] [client 20.196.101.49:5662] [client 20.196.101.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agtasU555B9CZb6D60kFxgAAAUM"]
[Tue May 19 02:30:11.519476 2026] [autoindex:error] [pid 36491:tid 36502] [client 20.196.101.49:3060] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 02:30:11.662199 2026] [autoindex:error] [pid 36491:tid 36495] [client 20.196.101.49:3060] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 02:30:12.720943 2026] [autoindex:error] [pid 36579:tid 36592] [client 20.196.101.49:3271] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 02:30:12.863360 2026] [autoindex:error] [pid 36579:tid 36584] [client 20.196.101.49:3271] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 04:49:51.520179 2026] [:error] [pid 38705:tid 38772] [client 103.65.237.216:55917] [client 103.65.237.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "agt7b8g5dNOZ5umN9lsNWAAAAIM"]
[Tue May 19 04:49:55.125571 2026] [:error] [pid 41573:tid 41596] [client 103.65.237.216:56231] [client 103.65.237.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/.vscode/sftp.json"] [unique_id "agt7cy1A2bd6JDSW9RYccgAAARU"]
[Wed May 20 08:20:18.390450 2026] [:error] [pid 44059:tid 44077] [client 20.104.227.76:64148] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/buy.php"] [unique_id "agz-QhfFs-oSOOcyjyxIlAAAARA"]
[Wed May 20 08:20:21.534173 2026] [:error] [pid 44059:tid 44072] [client 20.104.227.76:54667] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/buy.php"] [unique_id "agz-RRfFs-oSOOcyjyxImQAAAQs"]
[Wed May 20 08:20:22.930572 2026] [:error] [pid 41279:tid 41348] [client 20.104.227.76:58902] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/buy.php"] [unique_id "agz-RrEFyfaehGZbt4wzgwAAAMw"]
[Wed May 20 08:20:23.871368 2026] [:error] [pid 44059:tid 44085] [client 20.104.227.76:64132] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/buy.php"] [unique_id "agz-RxfFs-oSOOcyjyxInQAAARg"]
[Wed May 20 08:20:25.410320 2026] [:error] [pid 41364:tid 41375] [client 20.104.227.76:53078] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/core.php"] [unique_id "agz-SRKTmyvxtNXrN-g2eAAAAIk"]
[Wed May 20 08:20:26.699593 2026] [:error] [pid 44059:tid 44071] [client 20.104.227.76:64155] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/core.php"] [unique_id "agz-ShfFs-oSOOcyjyxIowAAAQo"]
[Wed May 20 08:20:28.766014 2026] [:error] [pid 44059:tid 44083] [client 20.104.227.76:61886] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/core.php"] [unique_id "agz-TBfFs-oSOOcyjyxIpgAAARY"]
[Wed May 20 08:20:30.449521 2026] [:error] [pid 41364:tid 41387] [client 20.104.227.76:58934] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/core.php"] [unique_id "agz-ThKTmyvxtNXrN-g2fwAAAJU"]
[Wed May 20 08:20:31.382957 2026] [:error] [pid 41279:tid 41347] [client 20.104.227.76:64158] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "agz-T7EFyfaehGZbt4wzjgAAAMs"]
[Wed May 20 08:20:32.731648 2026] [:error] [pid 41278:tid 41323] [client 20.104.227.76:61836] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "agz-UPWiNKASEfiGdwZknQAAAE4"]
[Wed May 20 08:20:34.460411 2026] [:error] [pid 44059:tid 44061] [client 20.104.227.76:9066] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "agz-UhfFs-oSOOcyjyxIrwAAAQA"]
[Wed May 20 08:20:36.507623 2026] [:error] [pid 41364:tid 41375] [client 20.104.227.76:9087] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/lock360.php"] [unique_id "agz-VBKTmyvxtNXrN-g2iQAAAIk"]
[Wed May 20 08:20:38.439860 2026] [:error] [pid 41278:tid 41319] [client 20.104.227.76:63449] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bc.php"] [unique_id "agz-VvWiNKASEfiGdwZknwAAAEo"]
[Wed May 20 08:20:40.071564 2026] [:error] [pid 44059:tid 44080] [client 20.104.227.76:9073] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bc.php"] [unique_id "agz-WBfFs-oSOOcyjyxI4AAAARM"]
[Wed May 20 08:20:42.191496 2026] [:error] [pid 44059:tid 44061] [client 20.104.227.76:58909] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bc.php"] [unique_id "agz-WhfFs-oSOOcyjyxJBQAAAQA"]
[Wed May 20 08:20:43.418484 2026] [:error] [pid 44059:tid 44083] [client 20.104.227.76:57442] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/bc.php"] [unique_id "agz-WxfFs-oSOOcyjyxJCwAAARY"]
[Wed May 20 08:20:45.081943 2026] [:error] [pid 41277:tid 41282] [client 20.104.227.76:58906] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/av.php"] [unique_id "agz-XbTTCltJmboB5ue7iQAAAAA"]
[Wed May 20 08:20:46.413731 2026] [:error] [pid 41364:tid 41380] [client 20.104.227.76:57462] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/av.php"] [unique_id "agz-XhKTmyvxtNXrN-g2qgAAAI4"]
[Wed May 20 08:20:47.672479 2026] [:error] [pid 41364:tid 41374] [client 20.104.227.76:9057] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/av.php"] [unique_id "agz-XxKTmyvxtNXrN-g2rgAAAIg"]
[Wed May 20 08:20:49.187778 2026] [:error] [pid 41277:tid 41290] [client 20.104.227.76:64190] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/av.php"] [unique_id "agz-YbTTCltJmboB5ue7iwAAAAg"]
[Wed May 20 08:20:50.688947 2026] [:error] [pid 41364:tid 41384] [client 20.104.227.76:58904] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/casp1.php"] [unique_id "agz-YhKTmyvxtNXrN-g2uQAAAJI"]
[Wed May 20 08:20:52.200828 2026] [:error] [pid 41364:tid 41378] [client 20.104.227.76:28134] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/casp1.php"] [unique_id "agz-ZBKTmyvxtNXrN-g2vwAAAIw"]
[Wed May 20 08:20:54.779180 2026] [:error] [pid 41277:tid 41305] [client 20.104.227.76:9176] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/casp1.php"] [unique_id "agz-ZrTTCltJmboB5ue7kAAAABc"]
[Wed May 20 08:20:56.297744 2026] [:error] [pid 41278:tid 41314] [client 20.104.227.76:57433] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/casp1.php"] [unique_id "agz-aPWiNKASEfiGdwZkpgAAAEU"]
[Wed May 20 08:20:58.993775 2026] [:error] [pid 44059:tid 44068] [client 20.104.227.76:62369] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/file6.php"] [unique_id "agz-ahfFs-oSOOcyjyxJGwAAAQc"]
[Wed May 20 08:21:01.621636 2026] [:error] [pid 44059:tid 44075] [client 20.104.227.76:32856] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/file6.php"] [unique_id "agz-bRfFs-oSOOcyjyxJHAAAAQ4"]
[Wed May 20 08:21:04.189835 2026] [:error] [pid 44059:tid 44083] [client 20.104.227.76:56840] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/file6.php"] [unique_id "agz-cBfFs-oSOOcyjyxJIQAAARY"]
[Wed May 20 08:21:05.448692 2026] [:error] [pid 44059:tid 44065] [client 20.104.227.76:56054] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/file6.php"] [unique_id "agz-cRfFs-oSOOcyjyxJJAAAAQQ"]
[Wed May 20 08:21:07.377251 2026] [:error] [pid 41279:tid 41360] [client 20.104.227.76:62366] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xs.php"] [unique_id "agz-c7EFyfaehGZbt4wzoAAAANg"]
[Wed May 20 08:21:12.252276 2026] [:error] [pid 41278:tid 41315] [client 20.104.227.76:56058] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xs.php"] [unique_id "agz-ePWiNKASEfiGdwZksQAAAEY"]
[Wed May 20 08:21:20.152748 2026] [:error] [pid 44059:tid 44062] [client 20.104.227.76:8611] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xs.php"] [unique_id "agz-gBfFs-oSOOcyjyxJMAAAAQE"]
[Wed May 20 08:21:23.597418 2026] [:error] [pid 44059:tid 44084] [client 20.104.227.76:54150] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xxa.php"] [unique_id "agz-gxfFs-oSOOcyjyxJNQAAARc"]
[Wed May 20 08:21:27.343415 2026] [:error] [pid 41364:tid 41386] [client 20.104.227.76:54170] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xxa.php"] [unique_id "agz-hxKTmyvxtNXrN-g22QAAAJQ"]
[Wed May 20 08:21:32.149762 2026] [:error] [pid 41278:tid 41310] [client 20.104.227.76:44272] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xxa.php"] [unique_id "agz-jPWiNKASEfiGdwZkzAAAAEE"]
[Wed May 20 08:21:33.796597 2026] [:error] [pid 44059:tid 44071] [client 20.104.227.76:44246] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xxa.php"] [unique_id "agz-jRfFs-oSOOcyjyxJOQAAAQo"]
[Wed May 20 08:21:35.980211 2026] [:error] [pid 44059:tid 44061] [client 20.104.227.76:44248] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/index0.php"] [unique_id "agz-jxfFs-oSOOcyjyxJPAAAAQA"]
[Wed May 20 08:21:42.196069 2026] [:error] [pid 44059:tid 44067] [client 20.104.227.76:55956] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/index0.php"] [unique_id "agz-lhfFs-oSOOcyjyxJUQAAAQY"]
[Wed May 20 08:21:44.308039 2026] [:error] [pid 41279:tid 41345] [client 20.104.227.76:58113] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/index0.php"] [unique_id "agz-mLEFyfaehGZbt4wz1gAAAMk"]
[Wed May 20 08:21:45.629297 2026] [:error] [pid 41279:tid 41337] [client 20.104.227.76:55538] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/index0.php"] [unique_id "agz-mbEFyfaehGZbt4wz2AAAAME"]
[Wed May 20 08:21:47.386412 2026] [:error] [pid 41364:tid 41366] [client 20.104.227.76:56948] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-kz.php"] [unique_id "agz-mxKTmyvxtNXrN-g2_gAAAIA"]
[Wed May 20 08:21:49.509866 2026] [:error] [pid 41279:tid 41358] [client 20.104.227.76:55498] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-kz.php"] [unique_id "agz-nbEFyfaehGZbt4wz4AAAANY"]
[Wed May 20 08:21:53.536207 2026] [:error] [pid 41279:tid 41352] [client 20.104.227.76:8285] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-kz.php"] [unique_id "agz-obEFyfaehGZbt4wz6QAAANA"]
[Wed May 20 08:21:56.824712 2026] [:error] [pid 41364:tid 41384] [client 20.104.227.76:58799] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-kz.php"] [unique_id "agz-pBKTmyvxtNXrN-g3BgAAAJI"]
[Wed May 20 08:22:00.466559 2026] [:error] [pid 44059:tid 44063] [client 20.104.227.76:61781] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/19.php"] [unique_id "agz-qBfFs-oSOOcyjyxJdQAAAQI"]
[Wed May 20 08:22:03.927842 2026] [:error] [pid 44059:tid 44073] [client 20.104.227.76:36254] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/19.php"] [unique_id "agz-qxfFs-oSOOcyjyxJewAAAQw"]
[Wed May 20 08:22:05.547107 2026] [:error] [pid 44059:tid 44065] [client 20.104.227.76:53027] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/19.php"] [unique_id "agz-rRfFs-oSOOcyjyxJhAAAAQQ"]
[Wed May 20 08:22:07.850533 2026] [:error] [pid 41279:tid 41343] [client 20.104.227.76:36255] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/19.php"] [unique_id "agz-r7EFyfaehGZbt4wz-wAAAMc"]
[Wed May 20 08:22:10.010502 2026] [:error] [pid 44059:tid 44064] [client 20.104.227.76:57353] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/11.php"] [unique_id "agz-shfFs-oSOOcyjyxJhgAAAQM"]
[Wed May 20 08:22:11.360957 2026] [:error] [pid 41277:tid 41291] [client 20.104.227.76:58223] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/11.php"] [unique_id "agz-s7TTCltJmboB5ue7xwAAAAk"]
[Wed May 20 08:22:12.758949 2026] [:error] [pid 41279:tid 41347] [client 20.104.227.76:36269] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/11.php"] [unique_id "agz-tLEFyfaehGZbt4w0AwAAAMs"]
[Wed May 20 08:22:14.233630 2026] [:error] [pid 41278:tid 41323] [client 20.104.227.76:59866] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/11.php"] [unique_id "agz-tvWiNKASEfiGdwZk7wAAAE4"]
[Wed May 20 08:22:16.972421 2026] [:error] [pid 44059:tid 44084] [client 20.104.227.76:36229] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/w.php"] [unique_id "agz-uBfFs-oSOOcyjyxJjAAAARc"]
[Wed May 20 08:22:19.815925 2026] [:error] [pid 44059:tid 44071] [client 20.104.227.76:50816] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/w.php"] [unique_id "agz-uxfFs-oSOOcyjyxJjgAAAQo"]
[Wed May 20 08:22:22.067979 2026] [:error] [pid 41364:tid 41387] [client 20.104.227.76:56483] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/w.php"] [unique_id "agz-vhKTmyvxtNXrN-g3FgAAAJU"]
[Wed May 20 08:22:23.538524 2026] [:error] [pid 41364:tid 41377] [client 20.104.227.76:65418] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/w.php"] [unique_id "agz-vxKTmyvxtNXrN-g3GAAAAIs"]
[Wed May 20 08:22:25.131846 2026] [:error] [pid 41279:tid 41349] [client 20.104.227.76:57382] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws78.php"] [unique_id "agz-wbEFyfaehGZbt4w0JQAAAM0"]
[Wed May 20 08:22:28.049229 2026] [:error] [pid 41278:tid 41326] [client 20.104.227.76:8837] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws78.php"] [unique_id "agz-xPWiNKASEfiGdwZlAQAAAFE"]
[Wed May 20 08:22:32.410854 2026] [:error] [pid 44059:tid 44069] [client 20.104.227.76:28351] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws78.php"] [unique_id "agz-yBfFs-oSOOcyjyxJnwAAAQg"]
[Wed May 20 08:22:36.960122 2026] [:error] [pid 41364:tid 41381] [client 20.104.227.76:64818] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws78.php"] [unique_id "agz-zBKTmyvxtNXrN-g3IgAAAI8"]
[Wed May 20 08:22:40.917049 2026] [:error] [pid 44059:tid 44071] [client 20.104.227.76:62281] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xxx.php"] [unique_id "agz-0BfFs-oSOOcyjyxJrwAAAQo"]
[Wed May 20 08:22:44.249271 2026] [:error] [pid 44059:tid 44064] [client 20.104.227.76:22855] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xxx.php"] [unique_id "agz-1BfFs-oSOOcyjyxJtAAAAQM"]
[Wed May 20 08:22:46.170782 2026] [:error] [pid 41364:tid 41376] [client 20.104.227.76:62315] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xxx.php"] [unique_id "agz-1hKTmyvxtNXrN-g3NwAAAIo"]
[Wed May 20 08:22:47.908810 2026] [:error] [pid 41279:tid 41339] [client 20.104.227.76:8497] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xxx.php"] [unique_id "agz-17EFyfaehGZbt4w0PwAAAMM"]
[Wed May 20 08:22:49.192475 2026] [:error] [pid 41364:tid 41377] [client 20.104.227.76:33995] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a7.php"] [unique_id "agz-2RKTmyvxtNXrN-g3PQAAAIs"]
[Wed May 20 08:22:51.753331 2026] [:error] [pid 44059:tid 44085] [client 20.104.227.76:31799] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a7.php"] [unique_id "agz-2xfFs-oSOOcyjyxJvQAAARg"]
[Wed May 20 08:22:53.952304 2026] [:error] [pid 44059:tid 44070] [client 20.104.227.76:27921] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a7.php"] [unique_id "agz-3RfFs-oSOOcyjyxJyQAAAQk"]
[Wed May 20 08:22:56.446328 2026] [:error] [pid 41279:tid 41360] [client 20.104.227.76:34021] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a7.php"] [unique_id "agz-4LEFyfaehGZbt4w0RgAAANg"]
[Wed May 20 08:22:59.087573 2026] [:error] [pid 44059:tid 44063] [client 20.104.227.76:27953] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/BDKR28WP.php"] [unique_id "agz-4xfFs-oSOOcyjyxJ2AAAAQI"]
[Wed May 20 08:23:02.659351 2026] [:error] [pid 41279:tid 41357] [client 20.104.227.76:31770] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/BDKR28WP.php"] [unique_id "agz-5rEFyfaehGZbt4w0SQAAANU"]
[Wed May 20 08:23:04.693272 2026] [:error] [pid 41279:tid 41343] [client 20.104.227.76:34016] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/BDKR28WP.php"] [unique_id "agz-6LEFyfaehGZbt4w0SwAAAMc"]
[Wed May 20 08:23:08.208547 2026] [:error] [pid 41364:tid 41384] [client 20.104.227.76:60385] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/BDKR28WP.php"] [unique_id "agz-7BKTmyvxtNXrN-g3XAAAAJI"]
[Wed May 20 08:23:10.727980 2026] [:error] [pid 41279:tid 41352] [client 20.104.227.76:34044] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a1.php"] [unique_id "agz-7rEFyfaehGZbt4w0WQAAANA"]
[Wed May 20 08:23:15.159772 2026] [:error] [pid 41278:tid 41312] [client 20.104.227.76:59295] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a1.php"] [unique_id "agz-8_WiNKASEfiGdwZlLwAAAEM"]
[Wed May 20 08:23:18.298818 2026] [:error] [pid 41277:tid 41299] [client 20.104.227.76:59290] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a1.php"] [unique_id "agz-9rTTCltJmboB5ue8AAAAABE"]
[Wed May 20 08:23:43.808873 2026] [:error] [pid 44059:tid 44085] [client 20.104.227.76:65430] [client 20.104.227.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tiny.php"] [unique_id "agz_DxfFs-oSOOcyjyxKEwAAARg"]
[Wed May 20 08:26:01.495932 2026] [:error] [pid 41364:tid 41385] [client 20.104.227.76:55941] [client 20.104.227.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "agz_mRKTmyvxtNXrN-g3_AAAAJM"]
[Wed May 20 14:34:00.730376 2026] [:error] [pid 41364:tid 41382] [client 34.46.57.55:65459] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "ag1V2BKTmyvxtNXrN-iUqAAAAJA"]
[Wed May 20 14:34:01.122523 2026] [:error] [pid 41364:tid 41369] [client 34.46.57.55:61910] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "ag1V2RKTmyvxtNXrN-iUvgAAAIM"]
[Wed May 20 14:34:01.510938 2026] [:error] [pid 44059:tid 44069] [client 34.46.57.55:54914] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2RfFs-oSOOcyjyzQiQAAAQg"]
[Wed May 20 16:47:38.412892 2026] [:error] [pid 41364:tid 41380] [client 45.129.32.13:16348] [client 45.129.32.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.129.32.13, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ag11KhKTmyvxtNXrN-ipVgAAAI4"]
[Thu May 21 00:46:40.349928 2026] [:error] [pid 7731:tid 7738] [client 17.246.23.233:34070] [client 17.246.23.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 17.246.23.233, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ag3lcH9qQlHXbkl2nEtZFgAAAYU"]
[Thu May 21 01:46:54.440563 2026] [autoindex:error] [pid 41277:tid 41282] [client 20.214.136.37:9330] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 01:47:08.752140 2026] [autoindex:error] [pid 41279:tid 41341] [client 20.214.136.37:6914] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 01:47:11.852618 2026] [autoindex:error] [pid 41364:tid 41387] [client 20.214.136.37:6969] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 01:47:12.695210 2026] [:error] [pid 41279:tid 41351] [client 20.214.136.37:9326] [client 20.214.136.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/requests/src/response/about.php"] [unique_id "ag3zoLEFyfaehGZbt4zBdwAAAM8"]
[Thu May 21 01:47:13.418124 2026] [:error] [pid 41278:tid 41325] [client 20.214.136.37:9280] [client 20.214.136.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.214.136.37, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ag3zofWiNKASEfiGdwbYzAAAAFA"]
[Thu May 21 01:47:14.631578 2026] [:error] [pid 7731:tid 7751] [client 20.214.136.37:7708] [client 20.214.136.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.214.136.37, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ag3zon9qQlHXbkl2nEtmbgAAAZI"]
[Thu May 21 01:47:25.580720 2026] [:error] [pid 41278:tid 41318] [client 20.214.136.37:3025] [client 20.214.136.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.214.136.37, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ag3zrfWiNKASEfiGdwbYzwAAAEk"]
[Thu May 21 01:47:31.382982 2026] [:error] [pid 7731:tid 7747] [client 20.214.136.37:3010] [client 20.214.136.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.214.136.37, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ag3zs39qQlHXbkl2nEtmkQAAAY4"]
[Thu May 21 01:47:36.683708 2026] [autoindex:error] [pid 41364:tid 41367] [client 20.214.136.37:6664] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 01:47:37.608429 2026] [:error] [pid 41279:tid 41358] [client 20.214.136.37:7707] [client 20.214.136.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ag3zubEFyfaehGZbt4zBhAAAANY"]
[Thu May 21 01:47:39.432436 2026] [autoindex:error] [pid 41279:tid 41359] [client 20.214.136.37:9899] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 01:47:39.576748 2026] [autoindex:error] [pid 41279:tid 41346] [client 20.214.136.37:9899] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 01:47:40.757467 2026] [autoindex:error] [pid 41278:tid 41327] [client 20.214.136.37:3063] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 01:47:40.925824 2026] [autoindex:error] [pid 41278:tid 41330] [client 20.214.136.37:3063] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 02:55:13.027025 2026] [:error] [pid 7731:tid 7751] [client 20.220.207.50:40714] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/19.php"] [unique_id "ag4DkX9qQlHXbkl2nEt0qwAAAZI"]
[Thu May 21 02:55:25.569752 2026] [:error] [pid 41278:tid 41314] [client 20.220.207.50:47180] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/19.php"] [unique_id "ag4DnfWiNKASEfiGdwbhNwAAAEU"]
[Thu May 21 02:55:28.794887 2026] [:error] [pid 7731:tid 7744] [client 20.220.207.50:9875] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/11.php"] [unique_id "ag4DoH9qQlHXbkl2nEt0ugAAAYs"]
[Thu May 21 02:55:31.700518 2026] [:error] [pid 7731:tid 7738] [client 20.220.207.50:47169] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/11.php"] [unique_id "ag4Do39qQlHXbkl2nEt0vwAAAYU"]
[Thu May 21 02:55:32.578925 2026] [:error] [pid 41279:tid 41357] [client 20.220.207.50:41461] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/11.php"] [unique_id "ag4DpLEFyfaehGZbt4zK0AAAANU"]
[Thu May 21 02:55:35.232743 2026] [:error] [pid 41364:tid 41371] [client 20.220.207.50:40763] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/11.php"] [unique_id "ag4DpxKTmyvxtNXrN-hEhgAAAIU"]
[Thu May 21 02:55:44.065757 2026] [:error] [pid 7664:tid 7668] [client 20.220.207.50:47190] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/w.php"] [unique_id "ag4DsHZ8s7o3eiqT2ks-egAAAUE"]
[Thu May 21 02:55:51.972003 2026] [:error] [pid 7731:tid 7738] [client 20.220.207.50:40711] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws78.php"] [unique_id "ag4Dt39qQlHXbkl2nEt04gAAAYU"]
[Thu May 21 02:56:02.253515 2026] [:error] [pid 41277:tid 41305] [client 20.220.207.50:47192] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ws78.php"] [unique_id "ag4DwrTTCltJmboB5ucoqAAAABc"]
[Thu May 21 02:56:28.870019 2026] [:error] [pid 41277:tid 41283] [client 20.220.207.50:9890] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a7.php"] [unique_id "ag4D3LTTCltJmboB5ucotQAAAAE"]
[Thu May 21 02:56:39.104696 2026] [:error] [pid 44059:tid 44073] [client 20.220.207.50:9886] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/BDKR28WP.php"] [unique_id "ag4D5xfFs-oSOOcyjyxq7wAAAQw"]
[Thu May 21 02:56:49.295079 2026] [:error] [pid 41364:tid 41385] [client 20.220.207.50:41438] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/BDKR28WP.php"] [unique_id "ag4D8RKTmyvxtNXrN-hEvQAAAJM"]
[Thu May 21 02:56:54.635130 2026] [:error] [pid 41279:tid 41341] [client 20.220.207.50:40710] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a1.php"] [unique_id "ag4D9rEFyfaehGZbt4zK_wAAAMU"]
[Thu May 21 02:57:06.851299 2026] [:error] [pid 41279:tid 41356] [client 20.220.207.50:9901] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/a1.php"] [unique_id "ag4EArEFyfaehGZbt4zLDQAAANQ"]
[Thu May 21 02:58:07.016579 2026] [:error] [pid 7664:tid 7671] [client 20.220.207.50:9443] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/son.php"] [unique_id "ag4EP3Z8s7o3eiqT2ks-3wAAAUQ"]
[Thu May 21 02:58:14.588817 2026] [:error] [pid 41277:tid 41300] [client 20.220.207.50:9654] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/son.php"] [unique_id "ag4ERrTTCltJmboB5uco5wAAABI"]
[Thu May 21 02:58:24.741179 2026] [:error] [pid 7664:tid 7675] [client 20.220.207.50:51140] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/doc.php"] [unique_id "ag4EUHZ8s7o3eiqT2ks--QAAAUg"]
[Thu May 21 02:58:30.302051 2026] [:error] [pid 41364:tid 41375] [client 20.220.207.50:9970] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/doc.php"] [unique_id "ag4EVhKTmyvxtNXrN-hFJAAAAIk"]
[Thu May 21 02:58:43.225658 2026] [:error] [pid 41279:tid 41358] [client 20.220.207.50:9262] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/zo.php"] [unique_id "ag4EY7EFyfaehGZbt4zLSwAAANY"]
[Thu May 21 02:58:53.737435 2026] [:error] [pid 7731:tid 7741] [client 20.220.207.50:10087] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/zo.php"] [unique_id "ag4EbX9qQlHXbkl2nEt1tgAAAYg"]
[Thu May 21 02:59:07.232590 2026] [:error] [pid 41364:tid 41375] [client 20.220.207.50:10081] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xper1.php"] [unique_id "ag4EexKTmyvxtNXrN-hFSwAAAIk"]
[Thu May 21 02:59:09.886982 2026] [:error] [pid 7664:tid 7682] [client 20.220.207.50:40535] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/xper1.php"] [unique_id "ag4EfXZ8s7o3eiqT2ks_FQAAAU8"]
[Thu May 21 02:59:17.140150 2026] [:error] [pid 7731:tid 7734] [client 20.220.207.50:9798] [client 20.220.207.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tiny.php"] [unique_id "ag4EhX9qQlHXbkl2nEt1yAAAAYE"]
[Thu May 21 02:59:23.220052 2026] [:error] [pid 41364:tid 41372] [client 20.220.207.50:40549] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/s1.php"] [unique_id "ag4EixKTmyvxtNXrN-hFVAAAAIY"]
[Thu May 21 02:59:35.790246 2026] [:error] [pid 41364:tid 41371] [client 20.220.207.50:49669] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/de.php"] [unique_id "ag4ElxKTmyvxtNXrN-hFaAAAAIU"]
[Thu May 21 02:59:39.791028 2026] [:error] [pid 41279:tid 41355] [client 20.220.207.50:49705] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/de.php"] [unique_id "ag4Em7EFyfaehGZbt4zLagAAANM"]
[Thu May 21 02:59:45.555384 2026] [:error] [pid 7731:tid 7742] [client 20.220.207.50:9813] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/de.php"] [unique_id "ag4EoX9qQlHXbkl2nEt18QAAAYk"]
[Thu May 21 02:59:46.642281 2026] [:error] [pid 41364:tid 41369] [client 20.220.207.50:9753] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/de.php"] [unique_id "ag4EohKTmyvxtNXrN-hFcwAAAIM"]
[Thu May 21 02:59:50.130312 2026] [:error] [pid 41364:tid 41383] [client 20.220.207.50:49690] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/1a.php"] [unique_id "ag4EphKTmyvxtNXrN-hFdQAAAJE"]
[Thu May 21 03:00:00.248175 2026] [:error] [pid 41279:tid 41340] [client 20.220.207.50:10187] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/f35.php"] [unique_id "ag4EsLEFyfaehGZbt4zLdAAAAMQ"]
[Thu May 21 03:00:04.721202 2026] [:error] [pid 41364:tid 41366] [client 20.220.207.50:10232] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/f35.php"] [unique_id "ag4EtBKTmyvxtNXrN-hFlgAAAIA"]
[Thu May 21 03:00:15.420271 2026] [:error] [pid 7731:tid 7742] [client 20.220.207.50:9379] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sky.php"] [unique_id "ag4Ev39qQlHXbkl2nEt2BQAAAYk"]
[Thu May 21 03:00:20.462438 2026] [:error] [pid 7731:tid 7753] [client 20.220.207.50:50674] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sky.php"] [unique_id "ag4ExH9qQlHXbkl2nEt2DwAAAZQ"]
[Thu May 21 03:00:26.789412 2026] [:error] [pid 41277:tid 41292] [client 20.220.207.50:10221] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sky.php"] [unique_id "ag4EyrTTCltJmboB5ucpHAAAAAo"]
[Thu May 21 03:00:40.211593 2026] [:error] [pid 7664:tid 7673] [client 20.220.207.50:9353] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/man.php"] [unique_id "ag4E2HZ8s7o3eiqT2ks_SAAAAUY"]
[Thu May 21 03:00:46.268980 2026] [:error] [pid 7664:tid 7685] [client 20.220.207.50:10213] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/man.php"] [unique_id "ag4E3nZ8s7o3eiqT2ks_VQAAAVI"]
[Thu May 21 03:00:56.468930 2026] [:error] [pid 41277:tid 41287] [client 20.220.207.50:10206] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ms-edit.php"] [unique_id "ag4E6LTTCltJmboB5ucpLwAAAAU"]
[Thu May 21 03:01:11.140196 2026] [:error] [pid 41278:tid 41316] [client 20.220.207.50:9765] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/themes.php"] [unique_id "ag4E9_WiNKASEfiGdwbh-gAAAEc"]
[Thu May 21 03:01:19.909971 2026] [:error] [pid 44059:tid 44062] [client 20.220.207.50:10215] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/themes.php"] [unique_id "ag4E_xfFs-oSOOcyjyxr9gAAAQE"]
[Thu May 21 03:01:30.730698 2026] [:error] [pid 41364:tid 41371] [client 20.220.207.50:10239] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/acp.php"] [unique_id "ag4FChKTmyvxtNXrN-hF8gAAAIU"]
[Thu May 21 03:01:33.041338 2026] [:error] [pid 41364:tid 41386] [client 20.220.207.50:50668] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/acp.php"] [unique_id "ag4FDRKTmyvxtNXrN-hF_gAAAJQ"]
[Thu May 21 03:01:37.884435 2026] [:error] [pid 41279:tid 41354] [client 20.220.207.50:9748] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/acp.php"] [unique_id "ag4FEbEFyfaehGZbt4zLngAAANI"]
[Thu May 21 03:01:45.814130 2026] [:error] [pid 41279:tid 41350] [client 20.220.207.50:9365] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/acp.php"] [unique_id "ag4FGbEFyfaehGZbt4zLpwAAAM4"]
[Thu May 21 03:01:51.209953 2026] [:error] [pid 44059:tid 44075] [client 20.220.207.50:44445] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/zdd.php"] [unique_id "ag4FHxfFs-oSOOcyjyxsCAAAAQ4"]
[Thu May 21 03:01:55.146087 2026] [:error] [pid 41364:tid 41375] [client 20.220.207.50:10200] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/zdd.php"] [unique_id "ag4FIxKTmyvxtNXrN-hGKwAAAIk"]
[Thu May 21 03:01:59.056169 2026] [:error] [pid 7664:tid 7678] [client 20.220.207.50:10182] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/zdd.php"] [unique_id "ag4FJ3Z8s7o3eiqT2ks_mgAAAUs"]
[Thu May 21 03:02:14.783198 2026] [:error] [pid 41364:tid 41387] [client 20.220.207.50:40475] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/link.php"] [unique_id "ag4FNhKTmyvxtNXrN-hGYQAAAJU"]
[Thu May 21 03:02:30.002419 2026] [:error] [pid 41364:tid 41388] [client 20.220.207.50:47190] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/sallu.php"] [unique_id "ag4FRhKTmyvxtNXrN-hGcgAAAJY"]
[Thu May 21 03:02:42.315708 2026] [:error] [pid 41364:tid 41367] [client 20.220.207.50:43993] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/aboute.php"] [unique_id "ag4FUhKTmyvxtNXrN-hGmAAAAIE"]
[Thu May 21 03:02:48.192028 2026] [:error] [pid 44059:tid 44070] [client 20.220.207.50:9311] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/aboute.php"] [unique_id "ag4FWBfFs-oSOOcyjyxsNQAAAQk"]
[Thu May 21 03:02:55.906748 2026] [:error] [pid 7664:tid 7670] [client 20.220.207.50:9322] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/aboute.php"] [unique_id "ag4FX3Z8s7o3eiqT2ks_zAAAAUM"]
[Thu May 21 03:02:57.076464 2026] [:error] [pid 41277:tid 41301] [client 20.220.207.50:41144] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ayk.php"] [unique_id "ag4FYbTTCltJmboB5ucpZwAAABM"]
[Thu May 21 03:03:00.059664 2026] [:error] [pid 41364:tid 41373] [client 20.220.207.50:9319] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ayk.php"] [unique_id "ag4FZBKTmyvxtNXrN-hGwwAAAIc"]
[Thu May 21 03:03:07.189100 2026] [:error] [pid 41364:tid 41375] [client 20.220.207.50:62321] [client 20.220.207.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/ayk.php"] [unique_id "ag4FaxKTmyvxtNXrN-hGyQAAAIk"]
[Thu May 21 03:12:06.045333 2026] [:error] [pid 7731:tid 7741] [client 20.220.207.50:10113] [client 20.220.207.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "ag4Hhn9qQlHXbkl2nEt4sgAAAYg"]
[Thu May 21 08:45:48.612861 2026] [autoindex:error] [pid 9114:tid 9127] [client 164.68.127.128:58191] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu May 21 08:56:33.605571 2026] [:error] [pid 9114:tid 9117] [client 194.163.173.74:51969] [client 194.163.173.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/sftp-config.json"] [unique_id "ag5YQW8FiJqDBEoTvqw2rQAAAUE"]
[Thu May 21 11:07:17.364618 2026] [:error] [pid 49982:tid 50006] [client 3.235.91.146:41300] [client 3.235.91.146] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/HEAD"] [unique_id "ag525WFwIDa5Tf8O4bZr-gAAANY"]
[Thu May 21 15:19:12.823642 2026] [:error] [pid 49884:tid 49969] [client 170.246.248.78:12348] [client 170.246.248.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.246.248.78, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ag6x8K5MPpsTNNHWS6h_LwAAAJY"]
[Thu May 21 19:51:09.382295 2026] [autoindex:error] [pid 49884:tid 49969] [client 20.205.110.7:7179] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 19:51:21.963232 2026] [autoindex:error] [pid 49982:tid 49991] [client 20.205.110.7:12429] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 19:51:24.551901 2026] [autoindex:error] [pid 49982:tid 49985] [client 20.205.110.7:7168] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 19:51:25.211738 2026] [:error] [pid 9189:tid 9225] [client 20.205.110.7:13756] [client 20.205.110.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/requests/src/response/about.php"] [unique_id "ag7xvZvTDh1NbYizKVywiwAAAgY"]
[Thu May 21 19:51:25.718392 2026] [:error] [pid 9157:tid 9175] [client 20.205.110.7:7177] [client 20.205.110.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.205.110.7, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ag7xvcGfHcLNqE8m88KPGAAAAZA"]
[Thu May 21 19:51:26.855405 2026] [:error] [pid 49982:tid 49994] [client 20.205.110.7:7661] [client 20.205.110.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.205.110.7, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ag7xvmFwIDa5Tf8O4bby8QAAAMo"]
[Thu May 21 19:51:35.791435 2026] [:error] [pid 49877:tid 49892] [client 20.205.110.7:11948] [client 20.205.110.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.205.110.7, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ag7xxxgN4MeSe4kIL9A6dAAAAAQ"]
[Thu May 21 19:51:40.720724 2026] [:error] [pid 49884:tid 49952] [client 20.205.110.7:11924] [client 20.205.110.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.205.110.7, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ag7xzK5MPpsTNNHWS6jZUgAAAIU"]
[Thu May 21 19:51:45.344505 2026] [autoindex:error] [pid 49982:tid 49993] [client 20.205.110.7:11915] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 19:51:46.160363 2026] [:error] [pid 49982:tid 50006] [client 20.205.110.7:11925] [client 20.205.110.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ag7x0mFwIDa5Tf8O4bbzCgAAANY"]
[Thu May 21 19:51:47.788813 2026] [autoindex:error] [pid 49877:tid 49895] [client 20.205.110.7:12448] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 19:51:47.939150 2026] [autoindex:error] [pid 49877:tid 49888] [client 20.205.110.7:12448] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 19:51:48.867226 2026] [autoindex:error] [pid 49877:tid 49901] [client 20.205.110.7:7214] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 19:51:48.997512 2026] [autoindex:error] [pid 49877:tid 49908] [client 20.205.110.7:7214] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 23:24:10.048932 2026] [:error] [pid 49884:tid 49966] [client 34.150.255.112:63736] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "ag8jmq5MPpsTNNHWS6gXZAAAAJM"]
[Thu May 21 23:24:10.490532 2026] [:error] [pid 49884:tid 49966] [client 34.150.255.112:54807] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "ag8jmq5MPpsTNNHWS6gX0gAAAJM"]
[Thu May 21 23:24:10.932059 2026] [:error] [pid 9188:tid 9200] [client 34.150.255.112:55801] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ag8jmrGYm6q5dNSUvA__GwAAAcg"]
[Fri May 22 09:13:14.019117 2026] [:error] [pid 15585:tid 15650] [client 104.131.109.103:60990] [client 104.131.109.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.131.109.103, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ag-tqiKb-vB41AF-LC2W1QAAAIM"]
[Fri May 22 09:50:03.312773 2026] [:error] [pid 58813:tid 58835] [client 157.245.65.47:61143] [client 157.245.65.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.245.65.47, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ag-2S56yyKWDKULhxJ0ihwAAAVM"]
[Fri May 22 13:06:50.429603 2026] [:error] [pid 15679:tid 15702] [client 13.88.218.223:1689] [client 13.88.218.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.88.218.223, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ag_kaih8tgGc38WJ-GzqfwAAANU"]
[Fri May 22 14:28:53.985639 2026] [:error] [pid 15585:tid 15658] [client 157.49.117.86:60865] [client 157.49.117.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.49.117.86, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ag_3pSKb-vB41AF-LC0OMwAAAIs"]
[Fri May 22 14:28:54.065498 2026] [:error] [pid 15585:tid 15650] [client 157.49.117.86:60866] [client 157.49.117.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.49.117.86, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ag_3piKb-vB41AF-LC0ONAAAAIM"]
[Fri May 22 14:29:30.608225 2026] [:error] [pid 15585:tid 15648] [client 72.14.147.205:55734] [client 72.14.147.205] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/backend/.env"] [unique_id "ag_3yiKb-vB41AF-LC0OUwAAAIE"]
[Fri May 22 14:29:30.608424 2026] [:error] [pid 15585:tid 15671] [client 72.14.147.205:55728] [client 72.14.147.205] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.development"] [unique_id "ag_3yiKb-vB41AF-LC0OVAAAAJg"]
[Fri May 22 14:29:30.660762 2026] [:error] [pid 58782:tid 58799] [client 72.14.147.205:55776] [client 72.14.147.205] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "ag_3yoxsdTFafgO8vhT4FwAAAQ8"]
[Fri May 22 14:29:30.842437 2026] [:error] [pid 15585:tid 15652] [client 72.14.147.205:55682] [client 72.14.147.205] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "ag_3yiKb-vB41AF-LC0OVgAAAIU"]
[Fri May 22 14:29:30.844587 2026] [:error] [pid 15679:tid 15691] [client 72.14.147.205:55724] [client 72.14.147.205] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production"] [unique_id "ag_3yih8tgGc38WJ-GwDmQAAAMo"]
[Fri May 22 14:29:30.844640 2026] [:error] [pid 15679:tid 15705] [client 72.14.147.205:55666] [client 72.14.147.205] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/HEAD"] [unique_id "ag_3yih8tgGc38WJ-GwDmgAAANg"]
[Fri May 22 14:29:30.844652 2026] [:error] [pid 58813:tid 58838] [client 72.14.147.205:55738] [client 72.14.147.205] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.env"] [unique_id "ag_3yp6yyKWDKULhxJ1RWwAAAVY"]
[Fri May 22 14:29:30.968114 2026] [:error] [pid 15584:tid 15631] [client 72.14.147.205:55708] [client 72.14.147.205] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local"] [unique_id "ag_3yt9Z_TVLbNEx52jqcQAAAEs"]
[Fri May 22 17:11:07.918640 2026] [:error] [pid 15585:tid 15662] [client 34.93.63.75:59724] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "ahAdqyKb-vB41AF-LC1JKAAAAI8"]
[Fri May 22 17:11:08.212342 2026] [:error] [pid 58782:tid 58808] [client 34.93.63.75:61304] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahAdrIxsdTFafgO8vhQNswAAARg"]
[Fri May 22 17:11:08.506022 2026] [:error] [pid 15584:tid 15637] [client 34.93.63.75:62788] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/feed/"] [unique_id "ahAdrN9Z_TVLbNEx52gMGgAAAFE"]
[Fri May 22 20:54:07.600700 2026] [:error] [pid 58813:tid 58835] [client 104.28.216.163:34384] [client 104.28.216.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "ahBR756yyKWDKULhxJ2IdgAAAVM"]
[Fri May 22 20:54:09.657785 2026] [:error] [pid 15585:tid 15647] [client 104.28.248.163:12023] [client 104.28.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/HEAD"] [unique_id "ahBR8SKb-vB41AF-LC2MrgAAAIA"]
[Fri May 22 23:59:55.963822 2026] [autoindex:error] [pid 15583:tid 15590] [client 62.84.183.159:61390] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat May 23 14:00:38.376931 2026] [:error] [pid 31039:tid 31054] [client 45.154.98.214:57629] [client 45.154.98.214] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||perthactive.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "perthactive.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "ahFChqIYDYo8WvA5zLLolQAAAM0"]
[Sat May 23 14:00:39.193216 2026] [:error] [pid 30940:tid 30951] [client 45.154.98.214:64300] [client 45.154.98.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.154.98.214, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ahFCh5qUP2XZmzp7RDrOEgAAAAI"]
[Sat May 23 14:58:02.731692 2026] [:error] [pid 25876:tid 25896] [client 49.43.202.168:56552] [client 49.43.202.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.202.168, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ahFP-gSpWUCKPezIBJBQmQAAARI"]
[Sat May 23 15:32:36.388453 2026] [:error] [pid 25876:tid 25892] [client 34.177.83.248:63061] [client 34.177.83.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.177.83.248, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ahFYFASpWUCKPezIBJBjEwAAAQ4"]
[Sat May 23 21:15:11.683251 2026] [:error] [pid 44325:tid 44332] [client 34.92.193.132:49270] [client 34.92.193.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "ahGoX1gUQb4puB_2yV8qjgAAAYQ"]
[Sun May 24 11:13:01.189691 2026] [:error] [pid 2639:tid 2646] [client 13.209.43.243:57818] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "ahJsvUzQncQTd0Z0Oe_9fAAAAQU"]
[Sun May 24 11:13:02.497041 2026] [:error] [pid 2639:tid 2645] [client 13.209.43.243:57850] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/credentials"] [unique_id "ahJsvkzQncQTd0Z0Oe_9gwAAAQQ"]
[Sun May 24 11:13:03.810025 2026] [:error] [pid 49689:tid 49722] [client 13.209.43.243:57868] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env"] [unique_id "ahJsvwaxiY3NxLUD97UxwQAAAIQ"]
[Sun May 24 11:13:04.515020 2026] [:error] [pid 49689:tid 49726] [client 13.209.43.243:57884] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.local"] [unique_id "ahJswAaxiY3NxLUD97UxwwAAAIg"]
[Sun May 24 11:13:05.254122 2026] [:error] [pid 2639:tid 2646] [client 13.209.43.243:57904] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.production"] [unique_id "ahJswUzQncQTd0Z0Oe_9igAAAQU"]
[Sun May 24 11:13:05.918415 2026] [:error] [pid 49744:tid 49766] [client 13.209.43.243:57918] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.staging"] [unique_id "ahJswTsE5kPdFpUbbHGC-AAAANQ"]
[Sun May 24 11:13:06.568306 2026] [:error] [pid 49744:tid 49753] [client 13.209.43.243:57926] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.development"] [unique_id "ahJswjsE5kPdFpUbbHGC-QAAAMc"]
[Sun May 24 11:13:07.247841 2026] [:error] [pid 49688:tid 49711] [client 13.209.43.243:57954] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.test"] [unique_id "ahJsw2YoQ9V6a_4pBsh1mAAAAFQ"]
[Sun May 24 11:13:08.232504 2026] [:error] [pid 49688:tid 49714] [client 13.209.43.243:57980] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.remote"] [unique_id "ahJsxGYoQ9V6a_4pBsh1oQAAAFc"]
[Sun May 24 11:13:08.909012 2026] [:error] [pid 23497:tid 23501] [client 13.209.43.243:35180] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.bak"] [unique_id "ahJsxCPlV47QcYwd2v9VtgAAAUE"]
[Sun May 24 11:13:09.583761 2026] [:error] [pid 49744:tid 49751] [client 13.209.43.243:35202] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.backup"] [unique_id "ahJsxTsE5kPdFpUbbHGDAgAAAMU"]
[Sun May 24 11:13:10.240589 2026] [:error] [pid 2639:tid 2653] [client 13.209.43.243:35232] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.save"] [unique_id "ahJsxkzQncQTd0Z0Oe_9kAAAAQw"]
[Sun May 24 11:13:10.871324 2026] [:error] [pid 2639:tid 2646] [client 13.209.43.243:35250] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.old"] [unique_id "ahJsxkzQncQTd0Z0Oe_9kgAAAQU"]
[Sun May 24 11:13:11.502345 2026] [:error] [pid 2639:tid 2659] [client 13.209.43.243:35266] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.sample"] [unique_id "ahJsx0zQncQTd0Z0Oe_9lgAAARI"]
[Sun May 24 11:13:12.142389 2026] [:error] [pid 2639:tid 2656] [client 13.209.43.243:35284] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.example"] [unique_id "ahJsyEzQncQTd0Z0Oe_9mwAAAQ8"]
[Sun May 24 11:13:12.794604 2026] [:error] [pid 49744:tid 49752] [client 13.209.43.243:35310] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.dev"] [unique_id "ahJsyDsE5kPdFpUbbHGDEAAAAMY"]
[Sun May 24 11:13:13.433944 2026] [:error] [pid 49688:tid 49714] [client 13.209.43.243:35330] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.prod"] [unique_id "ahJsyWYoQ9V6a_4pBsh1sgAAAFc"]
[Sun May 24 11:13:14.071967 2026] [:error] [pid 23497:tid 23523] [client 13.209.43.243:35350] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.stage"] [unique_id "ahJsyiPlV47QcYwd2v9VywAAAVc"]
[Sun May 24 11:13:15.002746 2026] [:error] [pid 23497:tid 23508] [client 13.209.43.243:35366] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.ci"] [unique_id "ahJsyyPlV47QcYwd2v9VzgAAAUg"]
[Sun May 24 11:13:16.315354 2026] [:error] [pid 49688:tid 49701] [client 13.209.43.243:35382] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.docker"] [unique_id "ahJszGYoQ9V6a_4pBsh1uwAAAEo"]
[Sun May 24 11:13:16.958901 2026] [:error] [pid 49689:tid 49739] [client 13.209.43.243:35414] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.live"] [unique_id "ahJszAaxiY3NxLUD97Ux0AAAAJU"]
[Sun May 24 11:13:17.623193 2026] [:error] [pid 2639:tid 2664] [client 13.209.43.243:35422] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.preprod"] [unique_id "ahJszUzQncQTd0Z0Oe_9qwAAARc"]
[Sun May 24 11:13:18.274087 2026] [:error] [pid 2639:tid 2642] [client 13.209.43.243:35440] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.uat"] [unique_id "ahJszkzQncQTd0Z0Oe_9rAAAAQE"]
[Sun May 24 11:13:18.910776 2026] [:error] [pid 49744:tid 49746] [client 13.209.43.243:50472] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.dist"] [unique_id "ahJszjsE5kPdFpUbbHGDFwAAAMA"]
[Sun May 24 11:13:19.592914 2026] [:error] [pid 23497:tid 23512] [client 13.209.43.243:50488] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.swp"] [unique_id "ahJszyPlV47QcYwd2v9V2wAAAUw"]
[Sun May 24 11:13:20.234883 2026] [:error] [pid 49689:tid 49721] [client 13.209.43.243:50510] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env~"] [unique_id "ahJs0AaxiY3NxLUD97Ux0QAAAIM"]
[Sun May 24 11:13:20.887305 2026] [:error] [pid 49689:tid 49722] [client 13.209.43.243:50518] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env1"] [unique_id "ahJs0AaxiY3NxLUD97Ux1AAAAIQ"]
[Sun May 24 11:13:21.544250 2026] [:error] [pid 49689:tid 49718] [client 13.209.43.243:50536] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env2"] [unique_id "ahJs0QaxiY3NxLUD97Ux1gAAAIA"]
[Sun May 24 11:13:22.183774 2026] [:error] [pid 49689:tid 49726] [client 13.209.43.243:50554] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env_copy"] [unique_id "ahJs0gaxiY3NxLUD97Ux2AAAAIg"]
[Sun May 24 11:13:22.844799 2026] [:error] [pid 49689:tid 49727] [client 13.209.43.243:50564] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.txt"] [unique_id "ahJs0gaxiY3NxLUD97Ux3AAAAIk"]
[Sun May 24 11:13:23.487187 2026] [:error] [pid 49689:tid 49729] [client 13.209.43.243:50586] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.json"] [unique_id "ahJs0waxiY3NxLUD97Ux4AAAAIs"]
[Sun May 24 11:13:24.119062 2026] [:error] [pid 49689:tid 49723] [client 13.209.43.243:50602] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.yaml"] [unique_id "ahJs1AaxiY3NxLUD97Ux5QAAAIU"]
[Sun May 24 11:13:24.751000 2026] [:error] [pid 49689:tid 49726] [client 13.209.43.243:50616] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.env.yml"] [unique_id "ahJs1AaxiY3NxLUD97Ux6gAAAIg"]
[Sun May 24 11:13:25.402912 2026] [:error] [pid 49744:tid 49750] [client 13.209.43.243:50628] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/app/.env"] [unique_id "ahJs1TsE5kPdFpUbbHGDGgAAAMQ"]
[Sun May 24 11:13:26.044684 2026] [:error] [pid 2639:tid 2646] [client 13.209.43.243:50636] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/apps/.env"] [unique_id "ahJs1kzQncQTd0Z0Oe_9zQAAAQU"]
[Sun May 24 11:13:26.690229 2026] [:error] [pid 49689:tid 49740] [client 13.209.43.243:50660] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/api/.env"] [unique_id "ahJs1gaxiY3NxLUD97UyDgAAAJY"]
[Sun May 24 11:13:27.711388 2026] [:error] [pid 2639:tid 2646] [client 13.209.43.243:50678] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/web/.env"] [unique_id "ahJs10zQncQTd0Z0Oe_93gAAAQU"]
[Sun May 24 11:13:29.131596 2026] [:error] [pid 49689:tid 49734] [client 13.209.43.243:46664] [client 13.209.43.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/site/.env"] [unique_id "ahJs2QaxiY3NxLUD97UyFwAAAJA"]
[Sun May 24 11:55:58.278130 2026] [:error] [pid 49775:tid 49794] [client 13.70.3.95:1367] [client 13.70.3.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.70.3.95, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ahJ2zovZb8G6T8WpI1hNBQAAABE"]
[Sun May 24 12:26:21.209919 2026] [:error] [pid 49744:tid 49752] [client 23.94.155.11:63941] [client 23.94.155.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 23.94.155.11, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ahJ97TsE5kPdFpUbbHGTNAAAAMY"]
[Sun May 24 13:59:32.155476 2026] [:error] [pid 23497:tid 23523] [client 172.232.206.244:41872] [client 172.232.206.244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.env"] [unique_id "ahKTxCPlV47QcYwd2v-apgAAAVc"]
[Sun May 24 13:59:32.167772 2026] [:error] [pid 23497:tid 23503] [client 172.232.206.244:41942] [client 172.232.206.244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/www/.env"] [unique_id "ahKTxCPlV47QcYwd2v-apwAAAUM"]
[Sun May 24 13:59:32.205562 2026] [:error] [pid 23497:tid 23510] [client 172.232.206.244:41904] [client 172.232.206.244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/admin/.env"] [unique_id "ahKTxCPlV47QcYwd2v-aqQAAAUo"]
[Sun May 24 13:59:32.206494 2026] [:error] [pid 23497:tid 23506] [client 172.232.206.244:41864] [client 172.232.206.244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "ahKTxCPlV47QcYwd2v-aqgAAAUY"]
[Sun May 24 13:59:32.206783 2026] [:error] [pid 23497:tid 23502] [client 172.232.206.244:41888] [client 172.232.206.244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/app/.env"] [unique_id "ahKTxCPlV47QcYwd2v-aqwAAAUI"]
[Sun May 24 13:59:32.209199 2026] [:error] [pid 49689:tid 49740] [client 172.232.206.244:41860] [client 172.232.206.244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.env"] [unique_id "ahKTxAaxiY3NxLUD97VSMAAAAJY"]
[Sun May 24 13:59:35.446453 2026] [:error] [pid 49689:tid 49737] [client 172.232.206.244:41944] [client 172.232.206.244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/storage/.env"] [unique_id "ahKTxwaxiY3NxLUD97VSMQAAAJM"]
[Sun May 24 13:59:35.446555 2026] [:error] [pid 49775:tid 49780] [client 172.232.206.244:41916] [client 172.232.206.244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/backend/.env"] [unique_id "ahKTx4vZb8G6T8WpI1hscQAAAAM"]
[Sun May 24 13:59:35.951335 2026] [:error] [pid 2639:tid 2663] [client 172.232.206.244:41926] [client 172.232.206.244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/public/.env"] [unique_id "ahKTx0zQncQTd0Z0Oe8y8wAAARY"]
[Sun May 24 14:34:02.601206 2026] [autoindex:error] [pid 49744:tid 49764] [client 95.111.239.37:61262] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun May 24 18:07:54.295415 2026] [:error] [pid 2639:tid 2662] [client 94.247.172.129:40847] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.perthactive.com.au|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.perthactive.com.au"] [uri "/"] [unique_id "ahLN-kzQncQTd0Z0Oe9ptQAAARU"]
[Sun May 24 18:31:06.756923 2026] [:error] [pid 49744:tid 49752] [client 49.151.163.71:50172] [client 49.151.163.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.151.163.71, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ahLTajsE5kPdFpUbbHHQNAAAAMY"]
[Sun May 24 21:59:39.947747 2026] [:error] [pid 11281:tid 11326] [client 20.195.178.143:19586] [client 20.195.178.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.195.178.143, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ahMES5KmC9taWvA91j6KcQAAAI0"]
[Sun May 24 21:59:52.620424 2026] [:error] [pid 11368:tid 11378] [client 20.195.178.143:19912] [client 20.195.178.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.195.178.143, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ahMEWIfq_sTmmtTKm1U3MgAAAQg"]
[Sun May 24 22:00:05.736141 2026] [autoindex:error] [pid 11281:tid 11318] [client 20.195.178.143:13374] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 24 22:00:06.104685 2026] [autoindex:error] [pid 11281:tid 11334] [client 20.195.178.143:13374] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 24 22:00:09.742063 2026] [autoindex:error] [pid 11282:tid 11357] [client 20.195.178.143:19943] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 24 22:00:10.050782 2026] [:error] [pid 11282:tid 11351] [client 20.195.178.143:19943] [client 20.195.178.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ahMEau0bPyN3C7HZ1R-oOQAAAMs"]
[Sun May 24 22:00:14.350926 2026] [autoindex:error] [pid 11282:tid 11345] [client 20.195.178.143:13316] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 24 22:00:14.706252 2026] [autoindex:error] [pid 11282:tid 11354] [client 20.195.178.143:13316] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 24 22:00:17.076332 2026] [autoindex:error] [pid 11282:tid 11348] [client 20.195.178.143:6065] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 24 22:00:17.389724 2026] [autoindex:error] [pid 11282:tid 11342] [client 20.195.178.143:6065] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 25 00:02:29.805064 2026] [:error] [pid 11368:tid 11384] [client 88.151.33.24:43690] [client 88.151.33.24] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/HEAD"] [unique_id "ahMhFYfq_sTmmtTKm1Vc4wAAAQ4"]
[Mon May 25 00:02:29.805381 2026] [:error] [pid 15835:tid 15843] [client 88.151.33.24:43684] [client 88.151.33.24] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.perthactive.com.au"] [uri "/.git/config"] [unique_id "ahMhFWWbknYlUM9P0qMX7QAAAAY"]
[Mon May 25 07:09:23.305398 2026] [:error] [pid 9303:tid 9338] [client 104.28.214.122:59645] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ms-themes.php"] [unique_id "ahOFI33bQScbssitjPRD4wAAAEQ"]
[Mon May 25 16:02:23.606705 2026] [:error] [pid 62427:tid 62468] [client 103.163.220.25:63935] [client 103.163.220.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "ahQCD_MUa83fc4GDyBxbqAAAAUs"]
[Mon May 25 16:02:23.975514 2026] [:error] [pid 62722:tid 62724] [client 103.163.220.47:33533] [client 103.163.220.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/inputs.php"] [unique_id "ahQCD6M6ssnLWYf6CVAdIgAAAEA"]
[Mon May 25 16:02:24.342997 2026] [:error] [pid 62427:tid 62460] [client 103.163.220.10:27453] [client 103.163.220.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/edit-tags.php"] [unique_id "ahQCEPMUa83fc4GDyBxbrAAAAUM"]
[Mon May 25 16:02:24.743385 2026] [:error] [pid 62427:tid 62478] [client 103.163.220.40:33211] [client 103.163.220.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/admin.php"] [unique_id "ahQCEPMUa83fc4GDyBxbrQAAAVU"]
[Mon May 25 16:02:25.112350 2026] [:error] [pid 3698:tid 3708] [client 103.163.220.44:45599] [client 103.163.220.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wpx/"] [unique_id "ahQCEQtZBEwA4fyFLKO6IgAAAQg"]
[Mon May 25 16:02:25.482020 2026] [:error] [pid 62722:tid 62748] [client 103.125.146.82:57057] [client 103.125.146.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/Nxploited/Nx.php"] [unique_id "ahQCEaM6ssnLWYf6CVAdJgAAAFg"]
[Mon May 25 16:02:25.856662 2026] [:error] [pid 62427:tid 62458] [client 103.163.220.34:22741] [client 103.163.220.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/filemanager.php"] [unique_id "ahQCEfMUa83fc4GDyBxbsQAAAUE"]
[Mon May 25 16:02:26.226600 2026] [:error] [pid 62427:tid 62468] [client 103.163.220.12:23571] [client 103.163.220.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/goods.php"] [unique_id "ahQCEvMUa83fc4GDyBxbtAAAAUs"]
[Mon May 25 16:02:26.594659 2026] [:error] [pid 62428:tid 62493] [client 103.163.220.35:56549] [client 103.163.220.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/about.php"] [unique_id "ahQCEpNosGBa7mui3VQZiwAAAIk"]
[Mon May 25 16:02:26.962875 2026] [:error] [pid 62428:tid 62486] [client 103.163.220.27:32593] [client 103.163.220.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/"] [unique_id "ahQCEpNosGBa7mui3VQZjAAAAII"]
[Mon May 25 16:02:27.332136 2026] [:error] [pid 62722:tid 62740] [client 103.163.220.34:34305] [client 103.163.220.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/3PJcpMFsD8B.php"] [unique_id "ahQCE6M6ssnLWYf6CVAdKAAAAFA"]
[Mon May 25 16:02:27.700177 2026] [:error] [pid 62427:tid 62465] [client 103.163.220.51:54047] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/"] [unique_id "ahQCE_MUa83fc4GDyBxbtQAAAUg"]
[Mon May 25 16:02:28.073580 2026] [:error] [pid 62427:tid 62459] [client 103.163.220.50:65517] [client 103.163.220.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/users.php"] [unique_id "ahQCFPMUa83fc4GDyBxbtgAAAUI"]
[Mon May 25 16:02:28.442497 2026] [:error] [pid 62427:tid 62479] [client 103.163.220.29:41447] [client 103.163.220.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/adminfuns.php"] [unique_id "ahQCFPMUa83fc4GDyBxbuAAAAVY"]
[Mon May 25 16:02:28.814385 2026] [:error] [pid 62426:tid 62434] [client 103.163.220.12:53255] [client 103.163.220.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/speculative8.php"] [unique_id "ahQCFEj3D3Mo8ANpTRDGPwAAAAQ"]
[Mon May 25 16:02:29.263947 2026] [:error] [pid 62426:tid 62431] [client 103.163.220.41:24755] [client 103.163.220.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/222.php"] [unique_id "ahQCFUj3D3Mo8ANpTRDGQAAAAAE"]
[Mon May 25 16:02:29.639784 2026] [:error] [pid 62722:tid 62734] [client 103.125.146.82:59151] [client 103.125.146.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403.php"] [unique_id "ahQCFaM6ssnLWYf6CVAdKwAAAEo"]
[Mon May 25 16:02:30.013722 2026] [:error] [pid 62426:tid 62452] [client 103.163.220.30:64443] [client 103.163.220.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/fm.php"] [unique_id "ahQCFkj3D3Mo8ANpTRDGQQAAABY"]
[Mon May 25 16:02:30.380900 2026] [:error] [pid 62426:tid 62453] [client 103.163.220.15:21645] [client 103.163.220.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/classwithtostring.php"] [unique_id "ahQCFkj3D3Mo8ANpTRDGRAAAABc"]
[Mon May 25 16:02:30.759350 2026] [:error] [pid 62722:tid 62743] [client 103.163.220.41:30605] [client 103.163.220.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/item.php"] [unique_id "ahQCFqM6ssnLWYf6CVAdLgAAAFM"]
[Mon May 25 16:02:31.145715 2026] [:error] [pid 62428:tid 62488] [client 103.125.146.81:51355] [client 103.125.146.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/admin.php"] [unique_id "ahQCF5NosGBa7mui3VQZkAAAAIQ"]
[Mon May 25 16:02:31.519282 2026] [:error] [pid 62722:tid 62738] [client 103.163.220.10:33225] [client 103.163.220.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/"] [unique_id "ahQCF6M6ssnLWYf6CVAdMAAAAE4"]
[Mon May 25 16:02:31.887466 2026] [:error] [pid 62722:tid 62735] [client 103.163.220.30:50595] [client 103.163.220.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hello-plus/classes/ehp-sarang.php"] [unique_id "ahQCF6M6ssnLWYf6CVAdMQAAAEs"]
[Mon May 25 16:02:32.255494 2026] [:error] [pid 62722:tid 62745] [client 103.163.220.40:45839] [client 103.163.220.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/edit-tags.php"] [unique_id "ahQCGKM6ssnLWYf6CVAdNAAAAFU"]
[Mon May 25 16:02:32.623211 2026] [:error] [pid 62722:tid 62747] [client 103.163.220.38:39271] [client 103.163.220.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/404.php"] [unique_id "ahQCGKM6ssnLWYf6CVAdNQAAAFc"]
[Mon May 25 16:02:32.993293 2026] [:error] [pid 62722:tid 62739] [client 103.163.220.33:38297] [client 103.163.220.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/news-portal/sitebar.php"] [unique_id "ahQCGKM6ssnLWYf6CVAdNwAAAE8"]
[Mon May 25 16:02:33.359600 2026] [:error] [pid 62426:tid 62450] [client 103.125.146.82:35761] [client 103.125.146.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/updates.php"] [unique_id "ahQCGUj3D3Mo8ANpTRDGRgAAABQ"]
[Mon May 25 16:02:33.732854 2026] [:error] [pid 3698:tid 3718] [client 103.163.220.51:61711] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/"] [unique_id "ahQCGQtZBEwA4fyFLKO6MgAAARI"]
[Mon May 25 16:02:34.101151 2026] [:error] [pid 62427:tid 62474] [client 103.163.220.22:23553] [client 103.163.220.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/1.php"] [unique_id "ahQCGvMUa83fc4GDyBxbwgAAAVE"]
[Mon May 25 16:02:39.477165 2026] [:error] [pid 3698:tid 3711] [client 103.163.220.31:22947] [client 103.163.220.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/file.php"] [unique_id "ahQCHwtZBEwA4fyFLKO6PAAAAQs"]
[Mon May 25 16:02:39.846790 2026] [:error] [pid 3698:tid 3705] [client 103.163.220.6:54031] [client 103.163.220.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/plugins/"] [unique_id "ahQCHwtZBEwA4fyFLKO6PgAAAQU"]
[Mon May 25 16:02:40.268196 2026] [:error] [pid 62428:tid 62496] [client 103.163.220.32:56051] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/mah.php"] [unique_id "ahQCIJNosGBa7mui3VQZlAAAAIw"]
[Mon May 25 16:02:40.638977 2026] [:error] [pid 62515:tid 62541] [client 103.163.220.35:51995] [client 103.163.220.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-config-sample.php"] [unique_id "ahQCIBig0_XsOwmnrv_r5wAAANg"]
[Mon May 25 16:02:41.007235 2026] [:error] [pid 3698:tid 3700] [client 103.163.220.53:22893] [client 103.163.220.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/"] [unique_id "ahQCIQtZBEwA4fyFLKO6QwAAAQA"]
[Mon May 25 16:02:41.375271 2026] [:error] [pid 3698:tid 3722] [client 103.163.220.49:28691] [client 103.163.220.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/"] [unique_id "ahQCIQtZBEwA4fyFLKO6RwAAARY"]
[Mon May 25 16:02:41.742514 2026] [:error] [pid 3698:tid 3719] [client 103.163.220.13:28349] [client 103.163.220.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyone/content-index.php"] [unique_id "ahQCIQtZBEwA4fyFLKO6SQAAARM"]
[Mon May 25 16:02:42.112015 2026] [:error] [pid 3698:tid 3717] [client 103.163.220.26:56475] [client 103.163.220.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/ssss/src.php"] [unique_id "ahQCIgtZBEwA4fyFLKO6SwAAARE"]
[Mon May 25 16:02:42.479604 2026] [:error] [pid 3698:tid 3723] [client 103.163.220.53:64717] [client 103.163.220.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "ahQCIgtZBEwA4fyFLKO6TgAAARc"]
[Mon May 25 16:02:42.847573 2026] [:error] [pid 62427:tid 62463] [client 103.163.220.22:60519] [client 103.163.220.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/radio.php"] [unique_id "ahQCIvMUa83fc4GDyBxbyAAAAUY"]
[Mon May 25 16:02:43.219903 2026] [:error] [pid 62722:tid 62725] [client 103.163.220.32:49747] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/"] [unique_id "ahQCI6M6ssnLWYf6CVAdPwAAAEE"]
[Mon May 25 16:02:43.586580 2026] [:error] [pid 3698:tid 3711] [client 103.163.220.13:52747] [client 103.163.220.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/images/"] [unique_id "ahQCIwtZBEwA4fyFLKO6UwAAAQs"]
[Mon May 25 16:02:43.955616 2026] [:error] [pid 62515:tid 62522] [client 103.125.146.81:22351] [client 103.125.146.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wordpress/wp-admin/maint/"] [unique_id "ahQCIxig0_XsOwmnrv_r6QAAAMU"]
[Mon May 25 16:02:44.324611 2026] [:error] [pid 62515:tid 62538] [client 103.163.220.41:23319] [client 103.163.220.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/files/"] [unique_id "ahQCJBig0_XsOwmnrv_r6wAAANU"]
[Mon May 25 16:02:49.694819 2026] [:error] [pid 53791:tid 53793] [client 103.163.220.39:28929] [client 103.163.220.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/404.php"] [unique_id "ahQCKSCRhhNTD40Nf1XTgwAAAYA"]
[Mon May 25 16:02:50.066838 2026] [:error] [pid 53791:tid 53796] [client 103.163.220.15:20059] [client 103.163.220.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/index/function.php"] [unique_id "ahQCKiCRhhNTD40Nf1XThQAAAYM"]
[Mon May 25 16:02:50.437749 2026] [:error] [pid 53791:tid 53799] [client 103.163.220.23:26397] [client 103.163.220.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/admin/"] [unique_id "ahQCKiCRhhNTD40Nf1XThgAAAYY"]
[Mon May 25 16:02:50.811182 2026] [:error] [pid 62426:tid 62443] [client 103.163.220.19:22227] [client 103.163.220.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp.php"] [unique_id "ahQCKkj3D3Mo8ANpTRDGaQAAAA0"]
[Mon May 25 16:02:51.180640 2026] [:error] [pid 62722:tid 62725] [client 103.163.220.38:43149] [client 103.163.220.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bless.php"] [unique_id "ahQCK6M6ssnLWYf6CVAdVAAAAEE"]
[Mon May 25 16:02:51.550073 2026] [:error] [pid 53791:tid 53808] [client 103.163.220.47:22151] [client 103.163.220.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/main_json.php"] [unique_id "ahQCKyCRhhNTD40Nf1XTjAAAAY8"]
[Mon May 25 16:02:56.916937 2026] [:error] [pid 62515:tid 62537] [client 103.163.220.32:20911] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "ahQCMBig0_XsOwmnrv_sBQAAANQ"]
[Mon May 25 16:02:57.285504 2026] [:error] [pid 53791:tid 53816] [client 103.163.220.35:53785] [client 103.163.220.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/x.php"] [unique_id "ahQCMSCRhhNTD40Nf1XTngAAAZc"]
[Mon May 25 16:02:57.655220 2026] [:error] [pid 3698:tid 3720] [client 103.163.220.55:46437] [client 103.163.220.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/"] [unique_id "ahQCMQtZBEwA4fyFLKO6gAAAARQ"]
[Mon May 25 16:02:58.039028 2026] [:error] [pid 53791:tid 53799] [client 103.163.220.8:36023] [client 103.163.220.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/"] [unique_id "ahQCMiCRhhNTD40Nf1XToQAAAYY"]
[Mon May 25 16:02:58.412350 2026] [:error] [pid 3698:tid 3701] [client 103.163.220.16:39725] [client 103.163.220.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/fukasawa/inc/classes/403.php"] [unique_id "ahQCMgtZBEwA4fyFLKO6ggAAAQE"]
[Mon May 25 16:02:58.780403 2026] [:error] [pid 53791:tid 53802] [client 103.163.220.16:63163] [client 103.163.220.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/config.php"] [unique_id "ahQCMiCRhhNTD40Nf1XTogAAAYk"]
[Mon May 25 16:02:59.221471 2026] [:error] [pid 3698:tid 3704] [client 103.163.220.54:51449] [client 103.163.220.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/"] [unique_id "ahQCMwtZBEwA4fyFLKO6hQAAAQQ"]
[Mon May 25 16:03:04.604059 2026] [:error] [pid 62426:tid 62432] [client 103.163.220.11:51125] [client 103.163.220.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/system.php"] [unique_id "ahQCOEj3D3Mo8ANpTRDGcwAAAAI"]
[Mon May 25 16:03:04.973892 2026] [:error] [pid 62428:tid 62504] [client 103.163.220.33:44021] [client 103.163.220.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/"] [unique_id "ahQCOJNosGBa7mui3VQZtQAAAJQ"]
[Mon May 25 16:03:05.339803 2026] [:error] [pid 62428:tid 62507] [client 103.163.220.55:59769] [client 103.163.220.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/.well-known/"] [unique_id "ahQCOZNosGBa7mui3VQZtwAAAJc"]
[Mon May 25 16:03:05.745868 2026] [:error] [pid 62428:tid 62506] [client 103.163.220.48:24519] [client 103.163.220.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "ahQCOZNosGBa7mui3VQZuAAAAJY"]
[Mon May 25 16:03:06.115604 2026] [:error] [pid 62428:tid 62505] [client 103.163.220.53:61327] [client 103.163.220.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/components/"] [unique_id "ahQCOpNosGBa7mui3VQZuQAAAJU"]
[Mon May 25 16:03:06.483086 2026] [:error] [pid 62428:tid 62484] [client 103.163.220.37:59781] [client 103.163.220.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/log.php"] [unique_id "ahQCOpNosGBa7mui3VQZugAAAIA"]
[Mon May 25 16:03:06.853400 2026] [:error] [pid 3698:tid 3706] [client 103.163.220.53:46163] [client 103.163.220.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/"] [unique_id "ahQCOgtZBEwA4fyFLKO6kwAAAQY"]
[Mon May 25 16:03:07.229732 2026] [:error] [pid 3698:tid 3723] [client 103.163.220.23:34333] [client 103.163.220.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/widgets/maint/"] [unique_id "ahQCOwtZBEwA4fyFLKO6lAAAARc"]
[Mon May 25 16:03:07.600662 2026] [:error] [pid 62722:tid 62734] [client 103.163.220.32:61367] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/simple.php"] [unique_id "ahQCO6M6ssnLWYf6CVAdXAAAAEo"]
[Mon May 25 16:03:07.972297 2026] [:error] [pid 62722:tid 62748] [client 103.163.220.14:30457] [client 103.163.220.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ab.php"] [unique_id "ahQCO6M6ssnLWYf6CVAdXQAAAFg"]
[Mon May 25 16:03:08.365670 2026] [:error] [pid 62428:tid 62494] [client 103.163.220.37:42875] [client 103.163.220.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "ahQCPJNosGBa7mui3VQZvQAAAIo"]
[Mon May 25 16:03:08.739465 2026] [:error] [pid 62428:tid 62502] [client 103.163.220.14:62083] [client 103.163.220.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-wlx.php"] [unique_id "ahQCPJNosGBa7mui3VQZvgAAAJI"]
[Mon May 25 16:03:09.109687 2026] [:error] [pid 62722:tid 62725] [client 103.163.220.52:20645] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/info.php"] [unique_id "ahQCPaM6ssnLWYf6CVAdYgAAAEE"]
[Mon May 25 16:03:09.477385 2026] [:error] [pid 62428:tid 62503] [client 103.163.220.41:36851] [client 103.163.220.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/widgets/"] [unique_id "ahQCPZNosGBa7mui3VQZwAAAAJM"]
[Mon May 25 16:03:09.842904 2026] [:error] [pid 3698:tid 3719] [client 103.163.220.19:50317] [client 103.163.220.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403x.php"] [unique_id "ahQCPQtZBEwA4fyFLKO6mgAAARM"]
[Mon May 25 16:03:10.216170 2026] [:error] [pid 62722:tid 62728] [client 103.163.220.35:62235] [client 103.163.220.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/"] [unique_id "ahQCPqM6ssnLWYf6CVAdYwAAAEQ"]
[Mon May 25 16:03:10.592713 2026] [:error] [pid 62428:tid 62499] [client 103.163.220.8:24593] [client 103.163.220.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ioxi-o.php"] [unique_id "ahQCPpNosGBa7mui3VQZwgAAAI8"]
[Mon May 25 16:03:11.197959 2026] [:error] [pid 62722:tid 62740] [client 103.163.220.27:25899] [client 103.163.220.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Exception/Transport/"] [unique_id "ahQCP6M6ssnLWYf6CVAdZQAAAFA"]
[Mon May 25 16:03:11.565726 2026] [:error] [pid 62722:tid 62735] [client 103.163.220.29:28767] [client 103.163.220.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-file.php"] [unique_id "ahQCP6M6ssnLWYf6CVAdaAAAAEs"]
[Mon May 25 16:03:11.933040 2026] [:error] [pid 62427:tid 62459] [client 103.163.220.37:32033] [client 103.163.220.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/m.php"] [unique_id "ahQCP_MUa83fc4GDyBxb7AAAAUI"]
[Mon May 25 16:03:12.300955 2026] [:error] [pid 62722:tid 62733] [client 103.163.220.20:25639] [client 103.163.220.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/themes/about.php"] [unique_id "ahQCQKM6ssnLWYf6CVAdawAAAEk"]
[Mon May 25 16:03:12.667011 2026] [:error] [pid 3698:tid 3707] [client 103.163.220.34:56025] [client 103.163.220.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "ahQCQAtZBEwA4fyFLKO6pAAAAQc"]
[Mon May 25 16:03:13.033813 2026] [:error] [pid 3698:tid 3714] [client 103.163.220.34:62087] [client 103.163.220.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/a.php"] [unique_id "ahQCQQtZBEwA4fyFLKO6pgAAAQ4"]
[Mon May 25 16:03:13.401861 2026] [:error] [pid 62722:tid 62730] [client 103.163.220.46:31725] [client 103.163.220.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/2024/"] [unique_id "ahQCQaM6ssnLWYf6CVAdbQAAAEY"]
[Mon May 25 16:03:13.769150 2026] [:error] [pid 3698:tid 3702] [client 103.163.220.48:48095] [client 103.163.220.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/admin.php"] [unique_id "ahQCQQtZBEwA4fyFLKO6qwAAAQI"]
[Mon May 25 16:03:14.137960 2026] [:error] [pid 62722:tid 62739] [client 103.163.220.33:28575] [client 103.163.220.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/shell/"] [unique_id "ahQCQqM6ssnLWYf6CVAdbgAAAE8"]
[Mon May 25 16:03:14.526089 2026] [:error] [pid 62722:tid 62746] [client 103.163.220.25:26977] [client 103.163.220.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/modern/test2.php"] [unique_id "ahQCQqM6ssnLWYf6CVAdcAAAAFY"]
[Mon May 25 16:03:14.894624 2026] [:error] [pid 3698:tid 3705] [client 103.163.220.51:45041] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/admin/function.php"] [unique_id "ahQCQgtZBEwA4fyFLKO6sQAAAQU"]
[Mon May 25 16:03:15.265485 2026] [:error] [pid 53791:tid 53794] [client 103.163.220.41:53207] [client 103.163.220.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/network/"] [unique_id "ahQCQyCRhhNTD40Nf1XTyQAAAYE"]
[Mon May 25 16:03:15.632431 2026] [:error] [pid 62427:tid 62471] [client 103.163.220.48:52479] [client 103.163.220.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/fukasawa/inc/classes/403x.php"] [unique_id "ahQCQ_MUa83fc4GDyBxb7QAAAU4"]
[Mon May 25 16:03:16.195992 2026] [:error] [pid 53791:tid 53804] [client 103.163.220.40:58789] [client 103.163.220.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/2025/"] [unique_id "ahQCRCCRhhNTD40Nf1XTywAAAYs"]
[Mon May 25 16:03:16.567267 2026] [:error] [pid 62427:tid 62457] [client 103.163.220.36:44021] [client 103.163.220.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/edit.php"] [unique_id "ahQCRPMUa83fc4GDyBxb7gAAAUA"]
[Mon May 25 16:03:16.934517 2026] [:error] [pid 62722:tid 62745] [client 103.163.220.18:56583] [client 103.163.220.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/header.php"] [unique_id "ahQCRKM6ssnLWYf6CVAdcgAAAFU"]
[Mon May 25 16:03:17.319995 2026] [:error] [pid 62722:tid 62736] [client 103.163.220.34:53107] [client 103.163.220.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ahax.php"] [unique_id "ahQCRaM6ssnLWYf6CVAdcwAAAEw"]
[Mon May 25 16:03:17.709624 2026] [:error] [pid 53791:tid 53810] [client 103.163.220.26:60765] [client 103.163.220.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/light/"] [unique_id "ahQCRSCRhhNTD40Nf1XTzgAAAZE"]
[Mon May 25 16:03:18.077135 2026] [:error] [pid 62515:tid 62521] [client 103.163.220.51:41915] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/packed.php"] [unique_id "ahQCRhig0_XsOwmnrv_sCQAAAMQ"]
[Mon May 25 16:03:18.458511 2026] [:error] [pid 62722:tid 62724] [client 103.163.220.10:32513] [client 103.163.220.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/code/"] [unique_id "ahQCRqM6ssnLWYf6CVAddAAAAEA"]
[Mon May 25 16:03:18.911585 2026] [:error] [pid 62722:tid 62744] [client 103.163.220.25:37779] [client 103.163.220.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/about.php"] [unique_id "ahQCRqM6ssnLWYf6CVAddQAAAFQ"]
[Mon May 25 16:03:19.284920 2026] [:error] [pid 62722:tid 62737] [client 103.163.220.15:55241] [client 103.163.220.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-bindings/"] [unique_id "ahQCR6M6ssnLWYf6CVAddgAAAE0"]
[Mon May 25 16:03:19.655156 2026] [:error] [pid 62722:tid 62740] [client 103.163.220.15:21709] [client 103.163.220.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/themes/"] [unique_id "ahQCR6M6ssnLWYf6CVAdeAAAAFA"]
[Mon May 25 16:03:20.021968 2026] [:error] [pid 53791:tid 53795] [client 103.163.220.51:30957] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/archives/"] [unique_id "ahQCSCCRhhNTD40Nf1XT0wAAAYI"]
[Mon May 25 16:03:20.390232 2026] [:error] [pid 62427:tid 62480] [client 103.163.220.13:45373] [client 103.163.220.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "ahQCSPMUa83fc4GDyBxb7wAAAVc"]
[Mon May 25 16:03:20.781000 2026] [:error] [pid 53791:tid 53796] [client 103.163.220.10:58845] [client 103.163.220.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "ahQCSCCRhhNTD40Nf1XT1AAAAYM"]
[Mon May 25 16:03:21.217538 2026] [:error] [pid 53791:tid 53813] [client 103.163.220.32:24591] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content.php"] [unique_id "ahQCSSCRhhNTD40Nf1XT1QAAAZQ"]
[Mon May 25 16:03:21.641085 2026] [:error] [pid 62428:tid 62498] [client 103.163.220.10:45161] [client 103.163.220.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/gk.php"] [unique_id "ahQCSZNosGBa7mui3VQZygAAAI4"]
[Mon May 25 16:03:22.010196 2026] [:error] [pid 53791:tid 53794] [client 103.163.220.19:36867] [client 103.163.220.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/"] [unique_id "ahQCSiCRhhNTD40Nf1XT1wAAAYE"]
[Mon May 25 16:03:22.378068 2026] [:error] [pid 53791:tid 53809] [client 103.163.220.34:50817] [client 103.163.220.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/config.php"] [unique_id "ahQCSiCRhhNTD40Nf1XT2AAAAZA"]
[Mon May 25 16:03:22.851632 2026] [:error] [pid 53791:tid 53811] [client 103.163.220.35:34153] [client 103.163.220.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/"] [unique_id "ahQCSiCRhhNTD40Nf1XT2wAAAZI"]
[Mon May 25 16:03:23.219671 2026] [:error] [pid 53791:tid 53813] [client 103.163.220.20:22169] [client 103.163.220.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/wp-blog.php"] [unique_id "ahQCSyCRhhNTD40Nf1XT3QAAAZQ"]
[Mon May 25 16:03:23.591901 2026] [:error] [pid 53791:tid 53797] [client 103.163.220.27:22029] [client 103.163.220.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/bolt.php"] [unique_id "ahQCSyCRhhNTD40Nf1XT4QAAAYQ"]
[Mon May 25 16:03:23.961358 2026] [:error] [pid 53791:tid 53807] [client 103.163.220.41:62399] [client 103.163.220.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/comments-pagination-numbers/"] [unique_id "ahQCSyCRhhNTD40Nf1XT5AAAAY4"]
[Mon May 25 16:03:24.349400 2026] [:error] [pid 53791:tid 53817] [client 103.163.220.22:51529] [client 103.163.220.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/login.php"] [unique_id "ahQCTCCRhhNTD40Nf1XT6AAAAZg"]
[Mon May 25 16:03:24.720007 2026] [:error] [pid 53791:tid 53808] [client 103.163.220.52:31535] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/IXR/"] [unique_id "ahQCTCCRhhNTD40Nf1XT7AAAAY8"]
[Mon May 25 16:03:25.091560 2026] [:error] [pid 53791:tid 53807] [client 103.163.220.10:44403] [client 103.163.220.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/plugin/"] [unique_id "ahQCTSCRhhNTD40Nf1XT8AAAAY4"]
[Mon May 25 16:03:25.459707 2026] [:error] [pid 53791:tid 53796] [client 103.163.220.22:58583] [client 103.163.220.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "ahQCTSCRhhNTD40Nf1XT8gAAAYM"]
[Mon May 25 16:03:26.000809 2026] [:error] [pid 62515:tid 62529] [client 103.163.220.27:44201] [client 103.163.220.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/buy.php"] [unique_id "ahQCTRig0_XsOwmnrv_sEAAAAMw"]
[Mon May 25 16:03:26.556966 2026] [:error] [pid 62428:tid 62491] [client 103.163.220.13:36589] [client 103.163.220.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/modern/"] [unique_id "ahQCTpNosGBa7mui3VQZzAAAAIc"]
[Mon May 25 16:03:26.935034 2026] [:error] [pid 62428:tid 62497] [client 103.163.220.53:59827] [client 103.163.220.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "ahQCTpNosGBa7mui3VQZ0AAAAI0"]
[Mon May 25 16:03:27.308909 2026] [:error] [pid 53791:tid 53809] [client 103.163.220.11:35261] [client 103.163.220.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/options.php"] [unique_id "ahQCTyCRhhNTD40Nf1XT9gAAAZA"]
[Mon May 25 16:03:27.675752 2026] [:error] [pid 53791:tid 53817] [client 103.163.220.25:62129] [client 103.163.220.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/panel.php"] [unique_id "ahQCTyCRhhNTD40Nf1XT9wAAAZg"]
[Mon May 25 16:03:28.052927 2026] [:error] [pid 53791:tid 53798] [client 103.163.220.30:39059] [client 103.163.220.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/coffee/"] [unique_id "ahQCUCCRhhNTD40Nf1XT-gAAAYU"]
[Mon May 25 16:03:28.420104 2026] [:error] [pid 53791:tid 53801] [client 103.163.220.32:54999] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ahQCUCCRhhNTD40Nf1XT_gAAAYg"]
[Mon May 25 16:03:28.792472 2026] [:error] [pid 53791:tid 53817] [client 103.163.220.25:64225] [client 103.163.220.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-good.php"] [unique_id "ahQCUCCRhhNTD40Nf1XUAgAAAZg"]
[Mon May 25 16:03:29.162842 2026] [:error] [pid 53791:tid 53798] [client 103.163.220.52:28525] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/upload.php"] [unique_id "ahQCUSCRhhNTD40Nf1XUBgAAAYU"]
[Mon May 25 16:03:29.539116 2026] [:error] [pid 53791:tid 53815] [client 103.163.220.32:43521] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyfive/"] [unique_id "ahQCUSCRhhNTD40Nf1XUCQAAAZY"]
[Mon May 25 16:03:29.926294 2026] [:error] [pid 62722:tid 62728] [client 103.163.220.38:45813] [client 103.163.220.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/class.php"] [unique_id "ahQCUaM6ssnLWYf6CVAdhgAAAEQ"]
[Mon May 25 16:03:30.312165 2026] [:error] [pid 62722:tid 62731] [client 103.163.220.15:64987] [client 103.163.220.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hello-plus/classes/ehp-bes.php"] [unique_id "ahQCUqM6ssnLWYf6CVAdhwAAAEc"]
[Mon May 25 16:03:30.795943 2026] [:error] [pid 53791:tid 53793] [client 103.163.220.30:39661] [client 103.163.220.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentythree/patterns/"] [unique_id "ahQCUiCRhhNTD40Nf1XUFgAAAYA"]
[Mon May 25 16:03:31.197262 2026] [:error] [pid 53791:tid 53797] [client 103.163.220.46:47159] [client 103.163.220.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/themes.php"] [unique_id "ahQCUyCRhhNTD40Nf1XUGQAAAYQ"]
[Mon May 25 16:03:31.567836 2026] [:error] [pid 53791:tid 53802] [client 103.163.220.29:28147] [client 103.163.220.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/edit-post/"] [unique_id "ahQCUyCRhhNTD40Nf1XUGgAAAYk"]
[Mon May 25 16:03:31.936339 2026] [:error] [pid 62722:tid 62737] [client 103.163.220.26:46647] [client 103.163.220.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/edit-wolf.php"] [unique_id "ahQCU6M6ssnLWYf6CVAdjAAAAE0"]
[Mon May 25 16:03:32.303998 2026] [:error] [pid 62722:tid 62738] [client 103.163.220.47:25391] [client 103.163.220.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/"] [unique_id "ahQCVKM6ssnLWYf6CVAdjwAAAE4"]
[Mon May 25 16:03:37.676073 2026] [:error] [pid 62427:tid 62464] [client 103.163.220.30:63241] [client 103.163.220.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/network/cache/"] [unique_id "ahQCWfMUa83fc4GDyBxb8wAAAUc"]
[Mon May 25 16:03:38.045490 2026] [:error] [pid 62426:tid 62437] [client 103.163.220.13:46029] [client 103.163.220.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/config.php"] [unique_id "ahQCWkj3D3Mo8ANpTRDGjwAAAAc"]
[Mon May 25 16:03:38.412226 2026] [:error] [pid 62428:tid 62507] [client 103.163.220.55:22449] [client 103.163.220.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/as.php"] [unique_id "ahQCWpNosGBa7mui3VQZ4QAAAJc"]
[Mon May 25 16:03:38.778872 2026] [:error] [pid 62722:tid 62729] [client 103.163.220.30:24363] [client 103.163.220.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/root.php"] [unique_id "ahQCWqM6ssnLWYf6CVAdnQAAAEU"]
[Mon May 25 16:03:39.150242 2026] [:error] [pid 62426:tid 62431] [client 103.163.220.28:40207] [client 103.163.220.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/chosen.php"] [unique_id "ahQCW0j3D3Mo8ANpTRDGkQAAAAE"]
[Mon May 25 16:03:39.516581 2026] [:error] [pid 62428:tid 62503] [client 103.163.220.24:63191] [client 103.163.220.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "ahQCW5NosGBa7mui3VQZ4gAAAJM"]
[Mon May 25 16:03:39.885972 2026] [:error] [pid 62428:tid 62506] [client 103.163.220.9:45669] [client 103.163.220.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/filester/assets/css/404.php"] [unique_id "ahQCW5NosGBa7mui3VQZ4wAAAJY"]
[Mon May 25 16:03:40.257098 2026] [:error] [pid 53791:tid 53803] [client 103.163.220.24:53423] [client 103.163.220.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/"] [unique_id "ahQCXCCRhhNTD40Nf1XUIgAAAYo"]
[Mon May 25 16:03:40.629530 2026] [:error] [pid 62428:tid 62505] [client 103.163.220.42:34035] [client 103.163.220.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wa/"] [unique_id "ahQCXJNosGBa7mui3VQZ5AAAAJU"]
[Mon May 25 16:03:40.994565 2026] [:error] [pid 3698:tid 3724] [client 103.163.220.40:22005] [client 103.163.220.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/network/"] [unique_id "ahQCXAtZBEwA4fyFLKO6wgAAARg"]
[Mon May 25 16:03:41.362360 2026] [:error] [pid 62428:tid 62486] [client 103.163.220.44:54755] [client 103.163.220.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/mini.php"] [unique_id "ahQCXZNosGBa7mui3VQZ5gAAAII"]
[Mon May 25 16:03:41.765423 2026] [:error] [pid 3698:tid 3710] [client 103.163.220.43:61763] [client 103.163.220.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "ahQCXQtZBEwA4fyFLKO6wwAAAQo"]
[Mon May 25 16:03:42.134924 2026] [:error] [pid 62427:tid 62479] [client 103.163.220.38:49333] [client 103.163.220.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/wp-conflg.php"] [unique_id "ahQCXvMUa83fc4GDyBxb9wAAAVY"]
[Mon May 25 16:03:42.505329 2026] [:error] [pid 62722:tid 62727] [client 103.163.220.10:34535] [client 103.163.220.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/mah/function.php"] [unique_id "ahQCXqM6ssnLWYf6CVAdowAAAEM"]
[Mon May 25 16:03:42.871249 2026] [:error] [pid 62722:tid 62729] [client 103.163.220.30:29141] [client 103.163.220.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/"] [unique_id "ahQCXqM6ssnLWYf6CVAdpQAAAEU"]
[Mon May 25 16:03:43.239688 2026] [:error] [pid 3698:tid 3720] [client 103.163.220.39:48417] [client 103.163.220.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/system_log.php"] [unique_id "ahQCXwtZBEwA4fyFLKO6xgAAARQ"]
[Mon May 25 16:03:43.607397 2026] [:error] [pid 3698:tid 3719] [client 103.163.220.19:42149] [client 103.163.220.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/comment-content/"] [unique_id "ahQCXwtZBEwA4fyFLKO6yAAAARM"]
[Mon May 25 16:03:44.081170 2026] [:error] [pid 62515:tid 62538] [client 103.163.220.6:45031] [client 103.163.220.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/"] [unique_id "ahQCYBig0_XsOwmnrv_sJwAAANU"]
[Mon May 25 16:03:44.449247 2026] [:error] [pid 62426:tid 62436] [client 103.163.220.17:62849] [client 103.163.220.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/t.php"] [unique_id "ahQCYEj3D3Mo8ANpTRDGlAAAAAY"]
[Mon May 25 16:03:44.817537 2026] [:error] [pid 62428:tid 62502] [client 103.163.220.15:60961] [client 103.163.220.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/worksec.php"] [unique_id "ahQCYJNosGBa7mui3VQZ6AAAAJI"]
[Mon May 25 16:03:45.188899 2026] [:error] [pid 62428:tid 62504] [client 103.163.220.47:27087] [client 103.163.220.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/dist/development/"] [unique_id "ahQCYZNosGBa7mui3VQZ6QAAAJQ"]
[Mon May 25 16:03:45.557802 2026] [:error] [pid 53791:tid 53797] [client 103.163.220.7:25053] [client 103.163.220.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/chosen.php"] [unique_id "ahQCYSCRhhNTD40Nf1XUNgAAAYQ"]
[Mon May 25 16:03:45.924883 2026] [:error] [pid 53791:tid 53795] [client 103.163.220.41:58341] [client 103.163.220.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade/"] [unique_id "ahQCYSCRhhNTD40Nf1XUOQAAAYI"]
[Mon May 25 16:03:46.291736 2026] [:error] [pid 53791:tid 53793] [client 103.163.220.24:59393] [client 103.163.220.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/fields/"] [unique_id "ahQCYiCRhhNTD40Nf1XUOwAAAYA"]
[Mon May 25 16:03:46.698447 2026] [:error] [pid 53791:tid 53810] [client 103.163.220.33:30041] [client 103.163.220.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/comment-date/"] [unique_id "ahQCYiCRhhNTD40Nf1XUPQAAAZE"]
[Mon May 25 16:03:47.066787 2026] [:error] [pid 53791:tid 53812] [client 103.163.220.47:38395] [client 103.163.220.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/lock360.php"] [unique_id "ahQCYyCRhhNTD40Nf1XUQAAAAZM"]
[Mon May 25 16:03:47.437738 2026] [:error] [pid 62515:tid 62517] [client 103.163.220.10:50377] [client 103.163.220.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/imgareaselect/"] [unique_id "ahQCYxig0_XsOwmnrv_sLgAAAMA"]
[Mon May 25 16:03:47.806395 2026] [:error] [pid 62515:tid 62539] [client 103.163.220.48:45507] [client 103.163.220.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/ocean/"] [unique_id "ahQCYxig0_XsOwmnrv_sMAAAANY"]
[Mon May 25 16:03:48.183357 2026] [:error] [pid 62428:tid 62507] [client 103.163.220.44:42787] [client 103.163.220.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/chosen.php"] [unique_id "ahQCZJNosGBa7mui3VQZ7gAAAJc"]
[Mon May 25 16:03:48.551087 2026] [:error] [pid 62427:tid 62466] [client 103.163.220.32:40293] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/"] [unique_id "ahQCZPMUa83fc4GDyBxb-gAAAUk"]
[Mon May 25 16:03:48.919044 2026] [:error] [pid 62722:tid 62727] [client 103.163.220.18:59843] [client 103.163.220.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "ahQCZKM6ssnLWYf6CVAdqQAAAEM"]
[Mon May 25 16:03:49.287500 2026] [:error] [pid 62428:tid 62487] [client 103.163.220.43:33839] [client 103.163.220.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyfour/"] [unique_id "ahQCZZNosGBa7mui3VQZ8wAAAIM"]
[Mon May 25 16:03:49.655679 2026] [:error] [pid 62428:tid 62498] [client 103.163.220.18:29393] [client 103.163.220.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/"] [unique_id "ahQCZZNosGBa7mui3VQZ9QAAAI4"]
[Mon May 25 16:03:50.025062 2026] [:error] [pid 62426:tid 62448] [client 103.163.220.31:53641] [client 103.163.220.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/customize-widgets/"] [unique_id "ahQCZkj3D3Mo8ANpTRDGmAAAABI"]
[Mon May 25 16:03:50.413735 2026] [:error] [pid 53791:tid 53808] [client 103.163.220.36:37099] [client 103.163.220.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/admin.php"] [unique_id "ahQCZiCRhhNTD40Nf1XURwAAAY8"]
[Mon May 25 16:03:50.794975 2026] [:error] [pid 62426:tid 62445] [client 103.163.220.28:64825] [client 103.163.220.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/"] [unique_id "ahQCZkj3D3Mo8ANpTRDGmwAAAA8"]
[Mon May 25 16:03:51.175482 2026] [:error] [pid 53791:tid 53813] [client 103.163.220.10:29365] [client 103.163.220.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/midnight/"] [unique_id "ahQCZyCRhhNTD40Nf1XUSwAAAZQ"]
[Mon May 25 16:03:51.544536 2026] [:error] [pid 62426:tid 62437] [client 103.163.220.47:51823] [client 103.163.220.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/css.php"] [unique_id "ahQCZ0j3D3Mo8ANpTRDGngAAAAc"]
[Mon May 25 16:03:56.932114 2026] [:error] [pid 53791:tid 53799] [client 103.163.220.40:58077] [client 103.163.220.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/footnotes/"] [unique_id "ahQCbCCRhhNTD40Nf1XUXAAAAYY"]
[Mon May 25 16:03:57.536642 2026] [:error] [pid 62515:tid 62537] [client 103.163.220.50:46671] [client 103.163.220.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/neve/assets/apps/dashboard/build/"] [unique_id "ahQCbRig0_XsOwmnrv_sNAAAANQ"]
[Mon May 25 16:03:57.905145 2026] [:error] [pid 62515:tid 62520] [client 103.163.220.48:53561] [client 103.163.220.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ws.php"] [unique_id "ahQCbRig0_XsOwmnrv_sNQAAAMM"]
[Mon May 25 16:03:58.271724 2026] [:error] [pid 62722:tid 62728] [client 103.163.220.16:45639] [client 103.163.220.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp.php"] [unique_id "ahQCbqM6ssnLWYf6CVAdsAAAAEQ"]
[Mon May 25 16:03:58.635946 2026] [:error] [pid 62426:tid 62445] [client 103.163.220.11:50509] [client 103.163.220.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/"] [unique_id "ahQCbkj3D3Mo8ANpTRDGpgAAAA8"]
[Mon May 25 16:03:59.015696 2026] [:error] [pid 53791:tid 53816] [client 103.163.220.9:36951] [client 103.163.220.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/maint/includes/"] [unique_id "ahQCbyCRhhNTD40Nf1XUYgAAAZc"]
[Mon May 25 16:04:04.455425 2026] [:error] [pid 62427:tid 62465] [client 103.163.220.46:60329] [client 103.163.220.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "ahQCdPMUa83fc4GDyBxb_gAAAUg"]
[Mon May 25 16:04:04.824746 2026] [:error] [pid 53791:tid 53795] [client 103.163.220.31:38223] [client 103.163.220.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/user.php"] [unique_id "ahQCdCCRhhNTD40Nf1XUcgAAAYI"]
[Mon May 25 16:04:05.191880 2026] [:error] [pid 62428:tid 62494] [client 103.163.220.15:55869] [client 103.163.220.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "ahQCdZNosGBa7mui3VQaAAAAAIo"]
[Mon May 25 16:04:05.559261 2026] [:error] [pid 62428:tid 62493] [client 103.163.220.40:65421] [client 103.163.220.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/module.php"] [unique_id "ahQCdZNosGBa7mui3VQaAQAAAIk"]
[Mon May 25 16:04:10.927866 2026] [:error] [pid 62515:tid 62534] [client 103.163.220.33:64769] [client 103.163.220.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/dx.php"] [unique_id "ahQCehig0_XsOwmnrv_sSQAAANE"]
[Mon May 25 16:04:11.307631 2026] [:error] [pid 62428:tid 62495] [client 103.163.220.52:47627] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/missing/"] [unique_id "ahQCe5NosGBa7mui3VQaCgAAAIs"]
[Mon May 25 16:04:11.673747 2026] [:error] [pid 62428:tid 62486] [client 103.163.220.38:34641] [client 103.163.220.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-signin.php"] [unique_id "ahQCe5NosGBa7mui3VQaCwAAAII"]
[Mon May 25 16:04:12.041057 2026] [:error] [pid 62515:tid 62537] [client 103.163.220.51:58603] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/buy.php"] [unique_id "ahQCfBig0_XsOwmnrv_sTAAAANQ"]
[Mon May 25 16:04:12.568328 2026] [:error] [pid 62427:tid 62461] [client 103.125.146.82:38247] [client 103.125.146.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyfour/patterns/template-singl-portfolio.php"] [unique_id "ahQCfPMUa83fc4GDyBxcBwAAAUQ"]
[Mon May 25 16:04:12.950534 2026] [:error] [pid 62427:tid 62478] [client 103.163.220.7:41561] [client 103.163.220.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/news-portal/user-install.php"] [unique_id "ahQCfPMUa83fc4GDyBxcCAAAAVU"]
[Mon May 25 16:04:13.317224 2026] [:error] [pid 62515:tid 62535] [client 103.163.220.43:53995] [client 103.163.220.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/system_core.php"] [unique_id "ahQCfRig0_XsOwmnrv_sTgAAANI"]
[Mon May 25 16:04:13.684801 2026] [:error] [pid 62426:tid 62434] [client 103.163.220.50:61881] [client 103.163.220.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/admin.php"] [unique_id "ahQCfUj3D3Mo8ANpTRDGrgAAAAQ"]
[Mon May 25 16:04:14.052080 2026] [:error] [pid 62427:tid 62468] [client 103.163.220.24:38893] [client 103.163.220.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/chosen.php"] [unique_id "ahQCfvMUa83fc4GDyBxcCgAAAUs"]
[Mon May 25 16:04:14.417454 2026] [:error] [pid 62515:tid 62533] [client 103.163.220.6:64757] [client 103.163.220.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/media/"] [unique_id "ahQCfhig0_XsOwmnrv_sUQAAANA"]
[Mon May 25 16:04:14.784629 2026] [:error] [pid 3698:tid 3705] [client 103.125.146.82:52797] [client 103.125.146.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/config.php"] [unique_id "ahQCfgtZBEwA4fyFLKO7BQAAAQU"]
[Mon May 25 16:04:15.154741 2026] [:error] [pid 62426:tid 62438] [client 103.163.220.9:30681] [client 103.163.220.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/freeform/"] [unique_id "ahQCf0j3D3Mo8ANpTRDGsAAAAAg"]
[Mon May 25 16:04:15.536505 2026] [:error] [pid 53791:tid 53812] [client 103.163.220.26:58801] [client 103.163.220.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/button/"] [unique_id "ahQCfyCRhhNTD40Nf1XUfwAAAZM"]
[Mon May 25 16:04:15.904686 2026] [:error] [pid 53791:tid 53794] [client 103.163.220.54:41793] [client 103.163.220.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/login.php"] [unique_id "ahQCfyCRhhNTD40Nf1XUgQAAAYE"]
[Mon May 25 16:04:16.272731 2026] [:error] [pid 53791:tid 53808] [client 103.163.220.12:28381] [client 103.163.220.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/database.php"] [unique_id "ahQCgCCRhhNTD40Nf1XUgwAAAY8"]
[Mon May 25 16:04:16.659878 2026] [:error] [pid 53791:tid 53810] [client 103.163.220.33:25557] [client 103.163.220.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "ahQCgCCRhhNTD40Nf1XUhQAAAZE"]
[Mon May 25 16:04:17.307969 2026] [:error] [pid 53791:tid 53796] [client 103.163.220.23:54923] [client 103.163.220.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/xxx.php"] [unique_id "ahQCgSCRhhNTD40Nf1XUigAAAYM"]
[Mon May 25 16:04:17.673793 2026] [:error] [pid 53791:tid 53814] [client 103.163.220.33:56519] [client 103.163.220.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/gallery/"] [unique_id "ahQCgSCRhhNTD40Nf1XUjQAAAZU"]
[Mon May 25 16:04:18.039649 2026] [:error] [pid 62515:tid 62526] [client 103.163.220.20:20023] [client 103.163.220.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/autoload_classmap.php"] [unique_id "ahQCghig0_XsOwmnrv_sWAAAAMk"]
[Mon May 25 16:04:18.407023 2026] [:error] [pid 53791:tid 53808] [client 103.163.220.52:49135] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/chosen.php"] [unique_id "ahQCgiCRhhNTD40Nf1XUkQAAAY8"]
[Mon May 25 16:04:18.773834 2026] [:error] [pid 62515:tid 62530] [client 103.163.220.49:20165] [client 103.163.220.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/group/"] [unique_id "ahQCghig0_XsOwmnrv_sXQAAAM0"]
[Mon May 25 16:04:19.149380 2026] [:error] [pid 3698:tid 3710] [client 103.163.220.8:40419] [client 103.163.220.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/Diff/Engine/template-singl-portfolio.php"] [unique_id "ahQCgwtZBEwA4fyFLKO7BwAAAQo"]
[Mon May 25 16:04:19.525505 2026] [:error] [pid 53791:tid 53816] [client 103.163.220.24:58481] [client 103.163.220.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/media-text/"] [unique_id "ahQCgyCRhhNTD40Nf1XUlAAAAZc"]
[Mon May 25 16:04:19.891056 2026] [:error] [pid 3698:tid 3716] [client 103.163.220.50:31083] [client 103.163.220.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/we.php"] [unique_id "ahQCgwtZBEwA4fyFLKO7CQAAARA"]
[Mon May 25 16:04:20.258979 2026] [:error] [pid 3698:tid 3711] [client 103.163.220.32:45437] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "ahQChAtZBEwA4fyFLKO7CwAAAQs"]
[Mon May 25 16:04:20.626375 2026] [:error] [pid 62428:tid 62486] [client 103.163.220.29:57035] [client 103.163.220.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/files.php"] [unique_id "ahQChJNosGBa7mui3VQaHAAAAII"]
[Mon May 25 16:04:25.998254 2026] [:error] [pid 62515:tid 62521] [client 103.163.220.39:45687] [client 103.163.220.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wmore1.php"] [unique_id "ahQCiRig0_XsOwmnrv_sbwAAAMQ"]
[Mon May 25 16:04:26.366162 2026] [:error] [pid 62515:tid 62540] [client 103.163.220.52:35171] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/namespaced/Core/"] [unique_id "ahQCihig0_XsOwmnrv_scQAAANc"]
[Mon May 25 16:04:26.743141 2026] [:error] [pid 62428:tid 62502] [client 103.163.220.44:60013] [client 103.163.220.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/src/Content/Type/"] [unique_id "ahQCipNosGBa7mui3VQaJAAAAJI"]
[Mon May 25 16:04:27.162226 2026] [:error] [pid 62515:tid 62534] [client 103.163.220.11:56579] [client 103.163.220.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyfour/assets/"] [unique_id "ahQCixig0_XsOwmnrv_sdQAAANE"]
[Mon May 25 16:04:27.528129 2026] [:error] [pid 62722:tid 62736] [client 103.163.220.43:31643] [client 103.163.220.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/file.php"] [unique_id "ahQCi6M6ssnLWYf6CVAdwwAAAEw"]
[Mon May 25 16:04:27.896384 2026] [:error] [pid 62722:tid 62734] [client 103.163.220.47:58317] [client 103.163.220.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/src/Core/"] [unique_id "ahQCi6M6ssnLWYf6CVAdxAAAAEo"]
[Mon May 25 16:04:28.262983 2026] [:error] [pid 62428:tid 62496] [client 103.163.220.49:38449] [client 103.163.220.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/library/"] [unique_id "ahQCjJNosGBa7mui3VQaJgAAAIw"]
[Mon May 25 16:04:28.631809 2026] [:error] [pid 62428:tid 62498] [client 103.163.220.34:39751] [client 103.163.220.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/l10n/"] [unique_id "ahQCjJNosGBa7mui3VQaKQAAAI4"]
[Mon May 25 16:04:28.998759 2026] [:error] [pid 62722:tid 62746] [client 103.163.220.32:55505] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/themes/"] [unique_id "ahQCjKM6ssnLWYf6CVAdyQAAAFY"]
[Mon May 25 16:04:29.368631 2026] [:error] [pid 62428:tid 62501] [client 103.163.220.32:38357] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/PHPMailer/widgets/"] [unique_id "ahQCjZNosGBa7mui3VQaLQAAAJE"]
[Mon May 25 16:04:29.734085 2026] [:error] [pid 62722:tid 62743] [client 103.163.220.54:45085] [client 103.163.220.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/radio.php"] [unique_id "ahQCjaM6ssnLWYf6CVAdzQAAAFM"]
[Mon May 25 16:04:30.100253 2026] [:error] [pid 53791:tid 53809] [client 103.163.220.38:47645] [client 103.163.220.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wp-config-backup.php"] [unique_id "ahQCjiCRhhNTD40Nf1XUmwAAAZA"]
[Mon May 25 16:04:30.467562 2026] [:error] [pid 62722:tid 62735] [client 103.163.220.50:46231] [client 103.163.220.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Exception/"] [unique_id "ahQCjqM6ssnLWYf6CVAdzwAAAEs"]
[Mon May 25 16:04:30.896004 2026] [:error] [pid 62722:tid 62742] [client 103.163.220.13:50249] [client 103.163.220.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/vx.php"] [unique_id "ahQCjqM6ssnLWYf6CVAd0AAAAFI"]
[Mon May 25 16:04:31.376770 2026] [:error] [pid 62722:tid 62732] [client 103.163.220.35:30205] [client 103.163.220.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "ahQCj6M6ssnLWYf6CVAd0gAAAEg"]
[Mon May 25 16:04:31.746660 2026] [:error] [pid 53791:tid 53815] [client 103.163.220.52:48721] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/theme/about.php"] [unique_id "ahQCjyCRhhNTD40Nf1XUnwAAAZY"]
[Mon May 25 16:04:32.119038 2026] [:error] [pid 53791:tid 53801] [client 103.163.220.32:39169] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/install.php"] [unique_id "ahQCkCCRhhNTD40Nf1XUoAAAAYg"]
[Mon May 25 16:04:32.489253 2026] [:error] [pid 53791:tid 53805] [client 103.163.220.17:21591] [client 103.163.220.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/accordion/"] [unique_id "ahQCkCCRhhNTD40Nf1XUogAAAYw"]
[Mon May 25 16:04:37.870414 2026] [:error] [pid 3698:tid 3711] [client 103.163.220.55:49043] [client 103.163.220.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/"] [unique_id "ahQClQtZBEwA4fyFLKO7FAAAAQs"]
[Mon May 25 16:04:38.281024 2026] [:error] [pid 53791:tid 53797] [client 103.163.220.18:30447] [client 103.163.220.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/shell.php"] [unique_id "ahQCliCRhhNTD40Nf1XUrgAAAYQ"]
[Mon May 25 16:04:38.657333 2026] [:error] [pid 53791:tid 53800] [client 103.163.220.29:45591] [client 103.163.220.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/elementor/css/"] [unique_id "ahQCliCRhhNTD40Nf1XUrwAAAYc"]
[Mon May 25 16:04:39.030748 2026] [:error] [pid 62515:tid 62541] [client 103.163.220.9:26811] [client 103.163.220.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/dist"] [unique_id "ahQClxig0_XsOwmnrv_siAAAANg"]
[Mon May 25 16:04:39.401524 2026] [:error] [pid 62722:tid 62726] [client 103.163.220.55:36131] [client 103.163.220.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/login.php"] [unique_id "ahQCl6M6ssnLWYf6CVAd2wAAAEI"]
[Mon May 25 16:04:39.772493 2026] [:error] [pid 62515:tid 62529] [client 103.163.220.38:36147] [client 103.163.220.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/"] [unique_id "ahQClxig0_XsOwmnrv_sjAAAAMw"]
[Mon May 25 16:04:40.139402 2026] [:error] [pid 62426:tid 62434] [client 103.163.220.25:22595] [client 103.163.220.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/dist/vendor/about.php"] [unique_id "ahQCmEj3D3Mo8ANpTRDGuQAAAAQ"]
[Mon May 25 16:04:40.507871 2026] [:error] [pid 62722:tid 62732] [client 103.163.220.35:43145] [client 103.163.220.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/pomo/"] [unique_id "ahQCmKM6ssnLWYf6CVAd3QAAAEg"]
[Mon May 25 16:04:40.873866 2026] [:error] [pid 62426:tid 62439] [client 103.163.220.36:46347] [client 103.163.220.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/php-compat/"] [unique_id "ahQCmEj3D3Mo8ANpTRDGuwAAAAk"]
[Mon May 25 16:04:41.244912 2026] [:error] [pid 53791:tid 53803] [client 103.163.220.9:53905] [client 103.163.220.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/222.php"] [unique_id "ahQCmSCRhhNTD40Nf1XUtQAAAYo"]
[Mon May 25 16:04:41.619646 2026] [:error] [pid 62428:tid 62508] [client 103.163.220.15:34759] [client 103.163.220.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/spacer/"] [unique_id "ahQCmZNosGBa7mui3VQaOgAAAJg"]
[Mon May 25 16:04:41.988968 2026] [:error] [pid 53791:tid 53804] [client 103.163.220.24:57697] [client 103.163.220.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/panel.php"] [unique_id "ahQCmSCRhhNTD40Nf1XUuQAAAYs"]
[Mon May 25 16:04:42.354937 2026] [:error] [pid 53791:tid 53810] [client 103.163.220.36:20217] [client 103.163.220.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/mediaelement/"] [unique_id "ahQCmiCRhhNTD40Nf1XUvAAAAZE"]
[Mon May 25 16:04:42.722594 2026] [:error] [pid 53791:tid 53798] [client 103.163.220.35:46471] [client 103.163.220.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/rest-api/endpoints/"] [unique_id "ahQCmiCRhhNTD40Nf1XUvgAAAYU"]
[Mon May 25 16:04:43.183194 2026] [:error] [pid 53791:tid 53796] [client 103.163.220.50:54415] [client 103.163.220.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "ahQCmyCRhhNTD40Nf1XUvwAAAYM"]
[Mon May 25 16:04:43.552480 2026] [:error] [pid 62426:tid 62437] [client 103.163.220.11:54399] [client 103.163.220.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/pullquote/"] [unique_id "ahQCm0j3D3Mo8ANpTRDGvAAAAAc"]
[Mon May 25 16:04:45.538036 2026] [:error] [pid 53791:tid 53801] [client 103.163.220.46:63139] [client 103.163.220.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Auth/"] [unique_id "ahQCnSCRhhNTD40Nf1XUxgAAAYg"]
[Mon May 25 16:04:45.910051 2026] [:error] [pid 53791:tid 53816] [client 103.163.220.41:32603] [client 103.163.220.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-file-manager-pro/"] [unique_id "ahQCnSCRhhNTD40Nf1XUyAAAAZc"]
[Mon May 25 16:04:46.283018 2026] [:error] [pid 62428:tid 62492] [client 103.125.146.81:47739] [client 103.125.146.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-file-manager-pro/fm_backup/"] [unique_id "ahQCnpNosGBa7mui3VQaQAAAAIg"]
[Mon May 25 16:04:46.649601 2026] [:error] [pid 53791:tid 53796] [client 103.163.220.29:39321] [client 103.163.220.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cgi-bin/cgi-bin/cgi-bin/config.php"] [unique_id "ahQCniCRhhNTD40Nf1XUzQAAAYM"]
[Mon May 25 16:04:47.017840 2026] [:error] [pid 62722:tid 62739] [client 103.163.220.32:38053] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/system.php"] [unique_id "ahQCn6M6ssnLWYf6CVAd4gAAAE8"]
[Mon May 25 16:04:47.384333 2026] [:error] [pid 53791:tid 53809] [client 103.163.220.53:55285] [client 103.163.220.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/fonts/lato/"] [unique_id "ahQCnyCRhhNTD40Nf1XUzgAAAZA"]
[Mon May 25 16:04:47.753415 2026] [:error] [pid 3698:tid 3713] [client 103.163.220.50:25401] [client 103.163.220.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/backup.php"] [unique_id "ahQCnwtZBEwA4fyFLKO7GgAAAQ0"]
[Mon May 25 16:04:48.126712 2026] [:error] [pid 62428:tid 62506] [client 103.163.220.31:32743] [client 103.163.220.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/backup.php"] [unique_id "ahQCoJNosGBa7mui3VQaQgAAAJY"]
[Mon May 25 16:04:48.496902 2026] [:error] [pid 53791:tid 53811] [client 103.163.220.40:30629] [client 103.163.220.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/login.php"] [unique_id "ahQCoCCRhhNTD40Nf1XU1AAAAZI"]
[Mon May 25 16:04:48.868464 2026] [:error] [pid 53791:tid 53798] [client 103.163.220.38:47067] [client 103.163.220.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/languages/themes/test.php"] [unique_id "ahQCoCCRhhNTD40Nf1XU1gAAAYU"]
[Mon May 25 16:04:49.297798 2026] [:error] [pid 3698:tid 3701] [client 103.163.220.51:46815] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Text/system_core.php"] [unique_id "ahQCoQtZBEwA4fyFLKO7HAAAAQE"]
[Mon May 25 16:04:49.736872 2026] [:error] [pid 62722:tid 62730] [client 103.125.146.82:32811] [client 103.125.146.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/maintenance.php"] [unique_id "ahQCoaM6ssnLWYf6CVAd5gAAAEY"]
[Mon May 25 16:04:55.112319 2026] [:error] [pid 62428:tid 62498] [client 103.163.220.8:60783] [client 103.163.220.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/666.php"] [unique_id "ahQCp5NosGBa7mui3VQaSwAAAI4"]
[Mon May 25 16:04:55.484221 2026] [:error] [pid 62428:tid 62492] [client 103.163.220.30:42517] [client 103.163.220.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/nic.php"] [unique_id "ahQCp5NosGBa7mui3VQaTwAAAIg"]
[Mon May 25 16:04:55.865138 2026] [:error] [pid 62515:tid 62531] [client 103.163.220.43:54993] [client 103.163.220.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/Molla1.5.6/wp-content/users.php"] [unique_id "ahQCpxig0_XsOwmnrv_soAAAAM4"]
[Mon May 25 16:05:01.236915 2026] [:error] [pid 53791:tid 53796] [client 103.163.220.19:41087] [client 103.163.220.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/mmenu.php"] [unique_id "ahQCrSCRhhNTD40Nf1XU3gAAAYM"]
[Mon May 25 16:05:01.608205 2026] [:error] [pid 53791:tid 53805] [client 103.163.220.13:37375] [client 103.163.220.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "ahQCrSCRhhNTD40Nf1XU4AAAAYw"]
[Mon May 25 16:05:01.983684 2026] [:error] [pid 62428:tid 62485] [client 103.163.220.26:61389] [client 103.163.220.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/elementor/classwithtostring.php"] [unique_id "ahQCrZNosGBa7mui3VQaUwAAAIE"]
[Mon May 25 16:05:02.358575 2026] [:error] [pid 53791:tid 53804] [client 103.163.220.15:63615] [client 103.163.220.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/elementor/google-fonts/fonts/"] [unique_id "ahQCriCRhhNTD40Nf1XU4wAAAYs"]
[Mon May 25 16:05:07.747041 2026] [:error] [pid 62722:tid 62735] [client 103.163.220.38:21009] [client 103.163.220.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/heading/"] [unique_id "ahQCs6M6ssnLWYf6CVAd8AAAAEs"]
[Mon May 25 16:05:08.122546 2026] [:error] [pid 62722:tid 62748] [client 103.163.220.31:34541] [client 103.163.220.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/geck.php"] [unique_id "ahQCtKM6ssnLWYf6CVAd8gAAAFg"]
[Mon May 25 16:05:08.600763 2026] [:error] [pid 53791:tid 53797] [client 103.163.220.32:20015] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wf-logs.php"] [unique_id "ahQCtCCRhhNTD40Nf1XU7wAAAYQ"]
[Mon May 25 16:05:09.024555 2026] [:error] [pid 53791:tid 53807] [client 103.163.220.28:28185] [client 103.163.220.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/l10n/wp-conflg.php"] [unique_id "ahQCtSCRhhNTD40Nf1XU8QAAAY4"]
[Mon May 25 16:05:09.400792 2026] [:error] [pid 53791:tid 53798] [client 103.163.220.22:63245] [client 103.163.220.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/home.php"] [unique_id "ahQCtSCRhhNTD40Nf1XU8wAAAYU"]
[Mon May 25 16:05:09.773971 2026] [:error] [pid 62722:tid 62743] [client 103.163.220.27:35427] [client 103.163.220.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cgi-bin/cgi-bin/cgi-bin/upload.php"] [unique_id "ahQCtaM6ssnLWYf6CVAd9wAAAFM"]
[Mon May 25 16:05:10.150416 2026] [:error] [pid 62722:tid 62724] [client 103.163.220.43:48477] [client 103.163.220.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cgi-bin/cgi-bin/panel.php"] [unique_id "ahQCtqM6ssnLWYf6CVAd-gAAAEA"]
[Mon May 25 16:05:10.526383 2026] [:error] [pid 62428:tid 62493] [client 103.163.220.46:60435] [client 103.163.220.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "ahQCtpNosGBa7mui3VQaXQAAAIk"]
[Mon May 25 16:05:10.901338 2026] [:error] [pid 53791:tid 53802] [client 103.163.220.51:24403] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/comment-date/wp-login.php"] [unique_id "ahQCtiCRhhNTD40Nf1XU9gAAAYk"]
[Mon May 25 16:05:11.274839 2026] [:error] [pid 62515:tid 62540] [client 103.163.220.43:44865] [client 103.163.220.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/templates/wp-login.php"] [unique_id "ahQCtxig0_XsOwmnrv_sqQAAANc"]
[Mon May 25 16:05:13.055414 2026] [:error] [pid 62428:tid 62505] [client 103.125.146.81:39141] [client 103.125.146.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "ahQCuZNosGBa7mui3VQaYAAAAJU"]
[Mon May 25 16:05:13.426175 2026] [:error] [pid 62427:tid 62481] [client 103.125.146.82:54867] [client 103.125.146.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "ahQCufMUa83fc4GDyBxcFgAAAVg"]
[Mon May 25 16:05:13.791933 2026] [:error] [pid 62427:tid 62468] [client 103.163.220.35:23013] [client 103.163.220.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/query-pagination-previous/wp-login.php"] [unique_id "ahQCufMUa83fc4GDyBxcGAAAAUs"]
[Mon May 25 16:05:14.175844 2026] [:error] [pid 62515:tid 62539] [client 103.163.220.10:63255] [client 103.163.220.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/rss/wp-login.php"] [unique_id "ahQCuhig0_XsOwmnrv_srwAAANY"]
[Mon May 25 16:05:14.543183 2026] [:error] [pid 62515:tid 62538] [client 103.125.146.82:31057] [client 103.125.146.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/search/"] [unique_id "ahQCuhig0_XsOwmnrv_ssQAAANU"]
[Mon May 25 16:05:14.909850 2026] [:error] [pid 62428:tid 62489] [client 103.163.220.52:20083] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/assets/"] [unique_id "ahQCupNosGBa7mui3VQaYwAAAIU"]
[Mon May 25 16:05:20.294938 2026] [:error] [pid 62428:tid 62504] [client 103.163.220.20:24267] [client 103.163.220.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/assets/about.php"] [unique_id "ahQCwJNosGBa7mui3VQaZwAAAJQ"]
[Mon May 25 16:05:20.672392 2026] [:error] [pid 53791:tid 53801] [client 103.163.220.36:24749] [client 103.163.220.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/query-title/about.php"] [unique_id "ahQCwCCRhhNTD40Nf1XVCwAAAYg"]
[Mon May 25 16:05:21.145161 2026] [:error] [pid 62428:tid 62507] [client 103.163.220.51:59845] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Exception/wp-login.php"] [unique_id "ahQCwZNosGBa7mui3VQaaAAAAJc"]
[Mon May 25 16:05:21.521656 2026] [:error] [pid 62428:tid 62486] [client 103.163.220.16:36839] [client 103.163.220.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/rss/about.php"] [unique_id "ahQCwZNosGBa7mui3VQaawAAAII"]
[Mon May 25 16:05:21.890158 2026] [:error] [pid 3698:tid 3717] [client 103.163.220.45:48945] [client 103.163.220.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/src/Core/wp-login.php"] [unique_id "ahQCwQtZBEwA4fyFLKO7NgAAARE"]
[Mon May 25 16:05:22.279469 2026] [:error] [pid 62428:tid 62501] [client 103.163.220.8:37811] [client 103.163.220.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/templates/about.php"] [unique_id "ahQCwpNosGBa7mui3VQabgAAAJE"]
[Mon May 25 16:05:22.652470 2026] [:error] [pid 53791:tid 53793] [client 103.163.220.44:25147] [client 103.163.220.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/query-title/"] [unique_id "ahQCwiCRhhNTD40Nf1XVEQAAAYA"]
[Mon May 25 16:05:23.024977 2026] [:error] [pid 53791:tid 53810] [client 103.163.220.51:25809] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/wp-login.php"] [unique_id "ahQCwyCRhhNTD40Nf1XVEwAAAZE"]
[Mon May 25 16:05:23.403157 2026] [:error] [pid 62515:tid 62517] [client 103.163.220.49:42649] [client 103.163.220.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/rss/"] [unique_id "ahQCwxig0_XsOwmnrv_svQAAAMA"]
[Mon May 25 16:05:23.792463 2026] [:error] [pid 3698:tid 3714] [client 103.163.220.20:26321] [client 103.163.220.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/src/Core/about.php"] [unique_id "ahQCwwtZBEwA4fyFLKO7OAAAAQ4"]
[Mon May 25 16:05:24.185953 2026] [:error] [pid 53791:tid 53811] [client 103.163.220.10:53925] [client 103.163.220.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/pullquote/wp-login.php"] [unique_id "ahQCxCCRhhNTD40Nf1XVFQAAAZI"]
[Mon May 25 16:05:24.556054 2026] [:error] [pid 53791:tid 53808] [client 103.163.220.14:56199] [client 103.163.220.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/query-title/wp-login.php"] [unique_id "ahQCxCCRhhNTD40Nf1XVFgAAAY8"]
[Mon May 25 16:05:24.923834 2026] [:error] [pid 62427:tid 62460] [client 103.163.220.50:60143] [client 103.163.220.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/about.php"] [unique_id "ahQCxPMUa83fc4GDyBxcJgAAAUM"]
[Mon May 25 16:05:25.293348 2026] [:error] [pid 62428:tid 62495] [client 103.163.220.37:40963] [client 103.163.220.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/query-pagination-previous/about.php"] [unique_id "ahQCxZNosGBa7mui3VQacgAAAIs"]
[Mon May 25 16:05:25.682911 2026] [:error] [pid 3698:tid 3706] [client 103.163.220.24:53979] [client 103.163.220.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/comment-date/about.php"] [unique_id "ahQCxQtZBEwA4fyFLKO7OwAAAQY"]
[Mon May 25 16:05:26.056124 2026] [:error] [pid 62426:tid 62442] [client 103.163.220.49:45563] [client 103.163.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/library/SimplePie/Parse/wp-login.php"] [unique_id "ahQCxkj3D3Mo8ANpTRDG2AAAAAw"]
[Mon May 25 16:05:26.439016 2026] [:error] [pid 53791:tid 53802] [client 103.163.220.27:60069] [client 103.163.220.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/pullquote/about.php"] [unique_id "ahQCxiCRhhNTD40Nf1XVGgAAAYk"]
[Mon May 25 16:05:26.820878 2026] [:error] [pid 3698:tid 3702] [client 103.163.220.29:62455] [client 103.163.220.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/preformatted/about.php"] [unique_id "ahQCxgtZBEwA4fyFLKO7PQAAAQI"]
[Mon May 25 16:05:27.189072 2026] [:error] [pid 53791:tid 53814] [client 103.163.220.47:31047] [client 103.163.220.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/about.php"] [unique_id "ahQCxyCRhhNTD40Nf1XVIAAAAZU"]
[Mon May 25 16:05:27.617846 2026] [:error] [pid 53791:tid 53794] [client 103.163.220.18:57315] [client 103.163.220.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/query-title/istsgd.php"] [unique_id "ahQCxyCRhhNTD40Nf1XVJgAAAYE"]
[Mon May 25 16:05:27.986378 2026] [:error] [pid 62426:tid 62437] [client 103.163.220.51:30829] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/code/about.php"] [unique_id "ahQCx0j3D3Mo8ANpTRDG2gAAAAc"]
[Mon May 25 16:05:28.366601 2026] [:error] [pid 62427:tid 62470] [client 103.163.220.29:22825] [client 103.163.220.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/social-links/wp-login.php"] [unique_id "ahQCyPMUa83fc4GDyBxcKgAAAU0"]
[Mon May 25 16:05:28.793115 2026] [:error] [pid 62427:tid 62468] [client 103.163.220.37:22471] [client 103.163.220.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/library/SimplePie/Parse/about.php"] [unique_id "ahQCyPMUa83fc4GDyBxcLAAAAUs"]
[Mon May 25 16:05:29.175905 2026] [:error] [pid 62515:tid 62540] [client 103.163.220.42:37417] [client 103.163.220.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/preformatted/wp-login.php"] [unique_id "ahQCyRig0_XsOwmnrv_swgAAANc"]
[Mon May 25 16:05:29.584786 2026] [:error] [pid 62427:tid 62467] [client 103.163.220.53:26667] [client 103.163.220.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/templates/"] [unique_id "ahQCyfMUa83fc4GDyBxcMAAAAUo"]
[Mon May 25 16:05:29.972561 2026] [:error] [pid 62515:tid 62530] [client 103.163.220.50:38251] [client 103.163.220.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/social-links/"] [unique_id "ahQCyRig0_XsOwmnrv_swwAAAM0"]
[Mon May 25 16:05:30.377644 2026] [:error] [pid 62515:tid 62523] [client 103.163.220.43:26711] [client 103.163.220.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/query-pagination-previous/"] [unique_id "ahQCyhig0_XsOwmnrv_sxAAAAMY"]
[Mon May 25 16:05:30.822389 2026] [:error] [pid 62428:tid 62507] [client 103.163.220.10:43603] [client 103.163.220.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/SimplePie/library/SimplePie/Parse/"] [unique_id "ahQCypNosGBa7mui3VQadwAAAJc"]
[Mon May 25 16:05:31.195324 2026] [:error] [pid 3698:tid 3724] [client 103.163.220.54:26765] [client 103.163.220.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/social-links/about.php"] [unique_id "ahQCywtZBEwA4fyFLKO7PwAAARg"]
[Mon May 25 16:05:31.661715 2026] [:error] [pid 3698:tid 3714] [client 103.163.220.51:47621] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "ahQCywtZBEwA4fyFLKO7QgAAAQ4"]
[Mon May 25 16:05:32.034969 2026] [:error] [pid 3698:tid 3711] [client 103.163.220.45:23799] [client 103.163.220.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-wp-site-edit.php"] [unique_id "ahQCzAtZBEwA4fyFLKO7RAAAAQs"]
[Mon May 25 16:05:32.429979 2026] [:error] [pid 62515:tid 62522] [client 103.163.220.36:58777] [client 103.163.220.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentynineteen/sass/site/header/"] [unique_id "ahQCzBig0_XsOwmnrv_sxQAAAMU"]
[Mon May 25 16:05:32.832083 2026] [:error] [pid 62427:tid 62466] [client 103.163.220.17:57603] [client 103.163.220.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/media-time.php"] [unique_id "ahQCzPMUa83fc4GDyBxcNgAAAUk"]
[Mon May 25 16:05:33.197848 2026] [:error] [pid 3698:tid 3703] [client 103.163.220.49:28315] [client 103.163.220.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/veq/aaa.php"] [unique_id "ahQCzQtZBEwA4fyFLKO7RwAAAQM"]
[Mon May 25 16:05:33.566784 2026] [:error] [pid 62426:tid 62452] [client 103.163.220.28:35297] [client 103.163.220.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/post-featured-image/"] [unique_id "ahQCzUj3D3Mo8ANpTRDG3AAAABY"]
[Mon May 25 16:05:34.171005 2026] [:error] [pid 3698:tid 3713] [client 103.163.220.16:56497] [client 103.163.220.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/riode/inc/add-on/live-search/"] [unique_id "ahQCzgtZBEwA4fyFLKO7TQAAAQ0"]
[Mon May 25 16:05:34.542089 2026] [:error] [pid 62426:tid 62434] [client 103.163.220.13:54761] [client 103.163.220.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyfive/assets/fonts/literata/"] [unique_id "ahQCzkj3D3Mo8ANpTRDG3gAAAAQ"]
[Mon May 25 16:05:34.926688 2026] [:error] [pid 62428:tid 62508] [client 103.163.220.36:52487] [client 103.163.220.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/post-author-name/"] [unique_id "ahQCzpNosGBa7mui3VQaegAAAJg"]
[Mon May 25 16:05:35.301582 2026] [:error] [pid 62428:tid 62498] [client 103.163.220.39:58587] [client 103.163.220.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/term-description/"] [unique_id "ahQCz5NosGBa7mui3VQafAAAAI4"]
[Mon May 25 16:05:35.685545 2026] [:error] [pid 62428:tid 62492] [client 103.163.220.48:48133] [client 103.163.220.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/shortcode/"] [unique_id "ahQCz5NosGBa7mui3VQafQAAAIg"]
[Mon May 25 16:05:36.218968 2026] [:error] [pid 62515:tid 62524] [client 103.163.220.18:21105] [client 103.163.220.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/math/"] [unique_id "ahQC0Big0_XsOwmnrv_syAAAAMc"]
[Mon May 25 16:05:36.590726 2026] [:error] [pid 62515:tid 62535] [client 103.163.220.20:36237] [client 103.163.220.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Utility/"] [unique_id "ahQC0Big0_XsOwmnrv_sygAAANI"]
[Mon May 25 16:05:36.961449 2026] [:error] [pid 62428:tid 62493] [client 103.163.220.25:46859] [client 103.163.220.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/crop/index.php"] [unique_id "ahQC0JNosGBa7mui3VQagwAAAIk"]
[Mon May 25 16:05:37.337941 2026] [:error] [pid 62515:tid 62534] [client 103.163.220.9:24057] [client 103.163.220.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/"] [unique_id "ahQC0Rig0_XsOwmnrv_szQAAANE"]
[Mon May 25 16:05:37.713570 2026] [:error] [pid 53791:tid 53817] [client 103.163.220.33:49271] [client 103.163.220.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/abilities-api/wp-conflg.php"] [unique_id "ahQC0SCRhhNTD40Nf1XVLAAAAZg"]
[Mon May 25 16:05:38.084369 2026] [:error] [pid 62428:tid 62494] [client 103.163.220.37:57609] [client 103.163.220.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/class-wp-image.php"] [unique_id "ahQC0pNosGBa7mui3VQahAAAAIo"]
[Mon May 25 16:05:38.479109 2026] [:error] [pid 62722:tid 62729] [client 103.163.220.53:33531] [client 103.163.220.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/fonts/bott.php"] [unique_id "ahQC0qM6ssnLWYf6CVAd_gAAAEU"]
[Mon May 25 16:05:38.855251 2026] [:error] [pid 62722:tid 62738] [client 103.163.220.53:64609] [client 103.163.220.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/admin.php"] [unique_id "ahQC0qM6ssnLWYf6CVAeAAAAAE4"]
[Mon May 25 16:05:39.225290 2026] [:error] [pid 53791:tid 53802] [client 103.163.220.18:25483] [client 103.163.220.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/chosen.php"] [unique_id "ahQC0yCRhhNTD40Nf1XVLwAAAYk"]
[Mon May 25 16:05:39.597038 2026] [:error] [pid 62428:tid 62486] [client 103.163.220.41:49377] [client 103.163.220.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/admin.php"] [unique_id "ahQC05NosGBa7mui3VQahwAAAII"]
[Mon May 25 16:05:39.970314 2026] [:error] [pid 62722:tid 62724] [client 103.163.220.38:36045] [client 103.163.220.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/zsdhb.php"] [unique_id "ahQC06M6ssnLWYf6CVAeAQAAAEA"]
[Mon May 25 16:05:40.362362 2026] [:error] [pid 62515:tid 62527] [client 103.163.220.46:44537] [client 103.163.220.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/revision-long.php"] [unique_id "ahQC1Big0_XsOwmnrv_s1AAAAMo"]
[Mon May 25 16:05:40.744077 2026] [:error] [pid 62427:tid 62478] [client 103.163.220.31:53509] [client 103.163.220.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/getid3-exception.php"] [unique_id "ahQC1PMUa83fc4GDyBxcOQAAAVU"]
[Mon May 25 16:05:41.115688 2026] [:error] [pid 3698:tid 3705] [client 103.163.220.51:56457] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/class-json-restful.php"] [unique_id "ahQC1QtZBEwA4fyFLKO7VQAAAQU"]
[Mon May 25 16:05:41.483883 2026] [:error] [pid 62515:tid 62531] [client 103.163.220.26:47529] [client 103.163.220.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/xml.php"] [unique_id "ahQC1Rig0_XsOwmnrv_s2AAAAM4"]
[Mon May 25 16:05:41.868550 2026] [:error] [pid 62427:tid 62462] [client 103.163.220.22:49999] [client 103.163.220.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/revision-path.php"] [unique_id "ahQC1fMUa83fc4GDyBxcOgAAAUU"]
[Mon May 25 16:05:42.235060 2026] [:error] [pid 3698:tid 3716] [client 103.163.220.12:52117] [client 103.163.220.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/media/build/irys/"] [unique_id "ahQC1gtZBEwA4fyFLKO7VgAAARA"]
[Mon May 25 16:05:42.610640 2026] [:error] [pid 62515:tid 62521] [client 103.163.220.50:32577] [client 103.163.220.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/details/xmu.php"] [unique_id "ahQC1hig0_XsOwmnrv_s2QAAAMQ"]
[Mon May 25 16:05:42.999662 2026] [:error] [pid 53791:tid 53794] [client 103.163.220.37:21557] [client 103.163.220.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/modern/dist/resources/js/tal/admin.php"] [unique_id "ahQC1iCRhhNTD40Nf1XVPAAAAYE"]
[Mon May 25 16:05:43.368386 2026] [:error] [pid 62515:tid 62530] [client 103.163.220.17:53241] [client 103.163.220.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/l10n/build/dist/cache/cache/uploads/build/uco/"] [unique_id "ahQC1xig0_XsOwmnrv_s2wAAAM0"]
[Mon May 25 16:05:43.737947 2026] [:error] [pid 62428:tid 62500] [client 103.163.220.36:59819] [client 103.163.220.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "ahQC15NosGBa7mui3VQajAAAAJA"]
[Mon May 25 16:05:44.109391 2026] [:error] [pid 62722:tid 62739] [client 103.163.220.37:61369] [client 103.163.220.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/images/chosen.php"] [unique_id "ahQC2KM6ssnLWYf6CVAeBQAAAE8"]
[Mon May 25 16:05:44.483865 2026] [:error] [pid 62722:tid 62736] [client 103.163.220.15:59455] [client 103.163.220.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/hlex/hlex2.php"] [unique_id "ahQC2KM6ssnLWYf6CVAeCAAAAEw"]
[Mon May 25 16:05:44.850461 2026] [:error] [pid 62515:tid 62521] [client 103.163.220.41:41467] [client 103.163.220.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/view-source/ioxi-o2.php"] [unique_id "ahQC2Big0_XsOwmnrv_s5QAAAMQ"]
[Mon May 25 16:05:45.330507 2026] [:error] [pid 53791:tid 53804] [client 103.163.220.36:33973] [client 103.163.220.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/network/cache/classwithtostring.php"] [unique_id "ahQC2SCRhhNTD40Nf1XVRAAAAYs"]
[Mon May 25 16:05:45.695500 2026] [:error] [pid 62427:tid 62481] [client 103.163.220.18:25471] [client 103.163.220.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/elex/1.php"] [unique_id "ahQC2fMUa83fc4GDyBxcOwAAAVg"]
[Mon May 25 16:05:46.068804 2026] [:error] [pid 62722:tid 62727] [client 103.163.220.9:27757] [client 103.163.220.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/elex/elex.php"] [unique_id "ahQC2qM6ssnLWYf6CVAeDQAAAEM"]
[Mon May 25 16:05:46.436172 2026] [:error] [pid 3698:tid 3703] [client 103.163.220.26:43513] [client 103.163.220.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/maintenance.php"] [unique_id "ahQC2gtZBEwA4fyFLKO7WgAAAQM"]
[Mon May 25 16:05:46.814366 2026] [:error] [pid 62426:tid 62440] [client 103.163.220.50:32565] [client 103.163.220.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/database/index.php"] [unique_id "ahQC2kj3D3Mo8ANpTRDG6gAAAAo"]
[Mon May 25 16:05:47.182164 2026] [:error] [pid 62427:tid 62464] [client 103.163.220.13:31245] [client 103.163.220.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/Divi/includes/builder/feature/ajax-data/"] [unique_id "ahQC2_MUa83fc4GDyBxcPAAAAUc"]
[Mon May 25 16:05:47.555381 2026] [:error] [pid 3698:tid 3722] [client 103.163.220.43:51393] [client 103.163.220.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/Divi/includes/builder/"] [unique_id "ahQC2wtZBEwA4fyFLKO7XQAAARY"]
[Mon May 25 16:05:47.927809 2026] [:error] [pid 62515:tid 62521] [client 103.163.220.25:40199] [client 103.163.220.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/goodbarber/models/media.php"] [unique_id "ahQC2xig0_XsOwmnrv_s9wAAAMQ"]
[Mon May 25 16:05:48.297132 2026] [:error] [pid 62427:tid 62467] [client 103.163.220.39:23447] [client 103.163.220.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/dev.ndmd.kn/wp-includes/Text/231.php"] [unique_id "ahQC3PMUa83fc4GDyBxcPgAAAUo"]
[Mon May 25 16:05:48.667937 2026] [:error] [pid 53791:tid 53808] [client 103.163.220.32:33303] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/classwithtostring.php"] [unique_id "ahQC3CCRhhNTD40Nf1XVSgAAAY8"]
[Mon May 25 16:05:49.036409 2026] [:error] [pid 62722:tid 62738] [client 103.163.220.42:29853] [client 103.163.220.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "ahQC3aM6ssnLWYf6CVAeEQAAAE4"]
[Mon May 25 16:05:49.411621 2026] [:error] [pid 62515:tid 62528] [client 103.163.220.44:38057] [client 103.163.220.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/dev.ndmd.kn/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "ahQC3Rig0_XsOwmnrv_tAAAAAMs"]
[Mon May 25 16:05:49.791447 2026] [:error] [pid 62722:tid 62741] [client 103.163.220.43:36259] [client 103.163.220.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wppa-depot/wp-conflg.php"] [unique_id "ahQC3aM6ssnLWYf6CVAeFAAAAFE"]
[Mon May 25 16:05:50.158209 2026] [:error] [pid 3698:tid 3704] [client 103.163.220.14:61707] [client 103.163.220.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/interactivity-api/wp-conflg.php"] [unique_id "ahQC3gtZBEwA4fyFLKO7YgAAAQQ"]
[Mon May 25 16:05:50.540230 2026] [:error] [pid 62426:tid 62448] [client 103.163.220.12:61191] [client 103.163.220.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/xjkuda.php"] [unique_id "ahQC3kj3D3Mo8ANpTRDG8wAAABI"]
[Mon May 25 16:05:50.923151 2026] [:error] [pid 3698:tid 3708] [client 103.125.146.81:53055] [client 103.125.146.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/login.php"] [unique_id "ahQC3gtZBEwA4fyFLKO7YwAAAQg"]
[Mon May 25 16:05:51.295096 2026] [:error] [pid 62427:tid 62475] [client 103.163.220.38:35811] [client 103.163.220.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/duplicator-pro/ctrls/class.web.services.php"] [unique_id "ahQC3_MUa83fc4GDyBxcQAAAAVI"]
[Mon May 25 16:05:51.667475 2026] [:error] [pid 62428:tid 62499] [client 103.163.220.25:38733] [client 103.163.220.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/min.php"] [unique_id "ahQC35NosGBa7mui3VQaqgAAAI8"]
[Mon May 25 16:05:52.037978 2026] [:error] [pid 62427:tid 62474] [client 103.163.220.8:26895] [client 103.163.220.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade/wordpress-6.9.1-partial-0/wordpress/wp-admin/admin.php"] [unique_id "ahQC4PMUa83fc4GDyBxcQQAAAVE"]
[Mon May 25 16:05:52.605461 2026] [:error] [pid 62515:tid 62517] [client 103.163.220.16:52129] [client 103.163.220.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade/wordpress-6.9.1-partial-0/wordpress/wp-includes/home.php"] [unique_id "ahQC4Big0_XsOwmnrv_tEQAAAMA"]
[Mon May 25 16:05:52.970735 2026] [:error] [pid 62515:tid 62519] [client 103.163.220.42:62415] [client 103.163.220.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/enhanced-text-widget1/analyst/src/403x.php"] [unique_id "ahQC4Big0_XsOwmnrv_tEwAAAMI"]
[Mon May 25 16:05:53.344283 2026] [:error] [pid 3698:tid 3721] [client 103.163.220.27:55579] [client 103.163.220.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/backup.php"] [unique_id "ahQC4QtZBEwA4fyFLKO7aQAAARU"]
[Mon May 25 16:05:53.712676 2026] [:error] [pid 62722:tid 62737] [client 103.163.220.52:37819] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "ahQC4aM6ssnLWYf6CVAeFgAAAE0"]
[Mon May 25 16:05:54.080744 2026] [:error] [pid 62722:tid 62748] [client 103.163.220.30:54351] [client 103.163.220.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wolf.php"] [unique_id "ahQC4qM6ssnLWYf6CVAeGAAAAFg"]
[Mon May 25 16:05:54.455072 2026] [:error] [pid 62722:tid 62725] [client 103.163.220.30:56315] [client 103.163.220.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/postnews.php"] [unique_id "ahQC4qM6ssnLWYf6CVAeGQAAAEE"]
[Mon May 25 16:05:54.822287 2026] [:error] [pid 62426:tid 62443] [client 103.163.220.34:34159] [client 103.163.220.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/maxro.php"] [unique_id "ahQC4kj3D3Mo8ANpTRDG_gAAAA0"]
[Mon May 25 16:05:55.197091 2026] [:error] [pid 62515:tid 62524] [client 103.163.220.45:54699] [client 103.163.220.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/akismet/_inc/img/PRffc.php"] [unique_id "ahQC4xig0_XsOwmnrv_tHgAAAMc"]
[Mon May 25 16:05:55.577517 2026] [:error] [pid 62426:tid 62439] [client 103.163.220.37:42991] [client 103.163.220.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/wpvivid_uploads/wp-conflg.php"] [unique_id "ahQC40j3D3Mo8ANpTRDHAgAAAAk"]
[Mon May 25 16:05:55.950684 2026] [:error] [pid 62722:tid 62741] [client 103.163.220.36:57263] [client 103.163.220.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/fukasawa/inc/classes/eroor.php"] [unique_id "ahQC46M6ssnLWYf6CVAeGwAAAFE"]
[Mon May 25 16:05:56.380107 2026] [:error] [pid 53791:tid 53801] [client 103.163.220.15:41511] [client 103.163.220.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/btx25.php"] [unique_id "ahQC5CCRhhNTD40Nf1XVWAAAAYg"]
[Mon May 25 16:05:56.748346 2026] [:error] [pid 53791:tid 53808] [client 103.163.220.13:59585] [client 103.163.220.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/users.php"] [unique_id "ahQC5CCRhhNTD40Nf1XVWQAAAY8"]
[Mon May 25 16:05:57.118086 2026] [:error] [pid 53791:tid 53816] [client 103.163.220.40:59529] [client 103.163.220.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/yosxb.php"] [unique_id "ahQC5SCRhhNTD40Nf1XVWgAAAZc"]
[Mon May 25 16:05:57.492352 2026] [:error] [pid 62722:tid 62744] [client 103.163.220.23:55961] [client 103.163.220.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wp-cache-sys/class-payment.php"] [unique_id "ahQC5aM6ssnLWYf6CVAeHAAAAFQ"]
[Mon May 25 16:05:57.858415 2026] [:error] [pid 53791:tid 53802] [client 103.163.220.14:51929] [client 103.163.220.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-patterns/chosen.php"] [unique_id "ahQC5SCRhhNTD40Nf1XVXQAAAYk"]
[Mon May 25 16:05:58.223835 2026] [:error] [pid 3698:tid 3717] [client 103.163.220.55:57071] [client 103.163.220.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/column/classwithtostring.php"] [unique_id "ahQC5gtZBEwA4fyFLKO7awAAARE"]
[Mon May 25 16:05:58.599531 2026] [:error] [pid 62722:tid 62736] [client 103.163.220.7:59701] [client 103.163.220.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/parts/"] [unique_id "ahQC5qM6ssnLWYf6CVAeHgAAAEw"]
[Mon May 25 16:05:58.966295 2026] [:error] [pid 62722:tid 62726] [client 103.163.220.40:51497] [client 103.163.220.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wp-cache-sys/file.php"] [unique_id "ahQC5qM6ssnLWYf6CVAeHwAAAEI"]
[Mon May 25 16:05:59.335911 2026] [:error] [pid 3698:tid 3707] [client 103.163.220.8:54869] [client 103.163.220.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/chillbud/inc/content/templates/"] [unique_id "ahQC5wtZBEwA4fyFLKO7bgAAAQc"]
[Mon May 25 16:05:59.730864 2026] [:error] [pid 53791:tid 53796] [client 103.163.220.41:23571] [client 103.163.220.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/revslider/admin/assets/js/plugins/admin.php"] [unique_id "ahQC5yCRhhNTD40Nf1XVYQAAAYM"]
[Mon May 25 16:06:00.102899 2026] [:error] [pid 62426:tid 62449] [client 103.163.220.15:27267] [client 103.163.220.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/wp-load.php"] [unique_id "ahQC6Ej3D3Mo8ANpTRDHCQAAABM"]
[Mon May 25 16:06:00.497660 2026] [:error] [pid 62428:tid 62499] [client 103.163.220.54:44923] [client 103.163.220.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/js_composer/assets/lib/bower/vcIconPicker/themes/xmlrpc.php"] [unique_id "ahQC6JNosGBa7mui3VQawAAAAI8"]
[Mon May 25 16:06:00.933180 2026] [:error] [pid 62427:tid 62473] [client 103.163.220.14:58829] [client 103.163.220.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/js_composer/assets/lib/bower/nivoslider/themes/module.php"] [unique_id "ahQC6PMUa83fc4GDyBxcRgAAAVA"]
[Mon May 25 16:06:01.301489 2026] [:error] [pid 3698:tid 3702] [client 103.163.220.47:26791] [client 103.163.220.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/sodium_compat/wp-conflg.php"] [unique_id "ahQC6QtZBEwA4fyFLKO7cAAAAQI"]
[Mon May 25 16:06:01.697008 2026] [:error] [pid 62426:tid 62447] [client 103.125.146.82:56117] [client 103.125.146.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/js_composer/include/classes/vendors/plugins/login.php"] [unique_id "ahQC6Uj3D3Mo8ANpTRDHCwAAABE"]
[Mon May 25 16:06:02.077529 2026] [:error] [pid 62426:tid 62453] [client 103.163.220.47:52257] [client 103.163.220.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/themes/api.php"] [unique_id "ahQC6kj3D3Mo8ANpTRDHDAAAABc"]
[Mon May 25 16:06:02.444251 2026] [:error] [pid 53791:tid 53797] [client 103.163.220.24:51631] [client 103.163.220.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/tinymce/plugins/wp-load.php"] [unique_id "ahQC6iCRhhNTD40Nf1XVZwAAAYQ"]
[Mon May 25 16:06:02.823465 2026] [:error] [pid 62428:tid 62490] [client 103.163.220.9:36969] [client 103.163.220.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/js_composer/include/classes/vendors/plugins/users.php"] [unique_id "ahQC6pNosGBa7mui3VQaxgAAAIY"]
[Mon May 25 16:06:03.189324 2026] [:error] [pid 3698:tid 3720] [client 103.163.220.40:32377] [client 103.163.220.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/js_composer/assets/js/frontend_editor/vendors/plugins/xmlrpc.php"] [unique_id "ahQC6wtZBEwA4fyFLKO7cgAAARQ"]
[Mon May 25 16:06:03.556187 2026] [:error] [pid 62722:tid 62733] [client 103.125.146.82:52597] [client 103.125.146.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/js_composer/assets/lib/vc_chart/"] [unique_id "ahQC66M6ssnLWYf6CVAeIwAAAEk"]
[Mon May 25 16:06:03.930839 2026] [:error] [pid 62426:tid 62451] [client 103.163.220.53:51853] [client 103.163.220.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/js/codemirror/"] [unique_id "ahQC60j3D3Mo8ANpTRDHDgAAABU"]
[Mon May 25 16:06:04.306342 2026] [:error] [pid 62722:tid 62741] [client 103.163.220.25:46841] [client 103.163.220.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/js_composer/assets/lib/vc_chart/about.php"] [unique_id "ahQC7KM6ssnLWYf6CVAeJAAAAFE"]
[Mon May 25 16:06:04.682019 2026] [:error] [pid 53791:tid 53814] [client 103.163.220.35:45411] [client 103.163.220.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/the-events-calendar/common/vendor/vendor-prefixed/monolog/monolog/about.php"] [unique_id "ahQC7CCRhhNTD40Nf1XVbAAAAZU"]
[Mon May 25 16:06:05.062165 2026] [:error] [pid 62426:tid 62448] [client 103.163.220.35:62049] [client 103.163.220.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/essential-grid/public/assets/font/fontello/css/about.php"] [unique_id "ahQC7Uj3D3Mo8ANpTRDHEAAAABI"]
[Mon May 25 16:06:05.428370 2026] [:error] [pid 62426:tid 62438] [client 103.163.220.52:62985] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/yosxb.php"] [unique_id "ahQC7Uj3D3Mo8ANpTRDHEgAAAAg"]
[Mon May 25 16:06:05.824950 2026] [:error] [pid 3698:tid 3717] [client 103.163.220.10:48253] [client 103.163.220.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/222.php"] [unique_id "ahQC7QtZBEwA4fyFLKO7dwAAARE"]
[Mon May 25 16:06:06.191321 2026] [:error] [pid 62428:tid 62492] [client 103.163.220.38:32241] [client 103.163.220.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/block-directory/"] [unique_id "ahQC7pNosGBa7mui3VQaygAAAIg"]
[Mon May 25 16:06:06.559233 2026] [:error] [pid 3698:tid 3712] [client 103.163.220.9:30207] [client 103.163.220.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentynineteen/sass/forms/"] [unique_id "ahQC7gtZBEwA4fyFLKO7egAAAQw"]
[Mon May 25 16:06:06.961385 2026] [:error] [pid 62427:tid 62474] [client 103.163.220.52:54219] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-patterns/mmm.php"] [unique_id "ahQC7vMUa83fc4GDyBxcSQAAAVE"]
[Mon May 25 16:06:07.333992 2026] [:error] [pid 62515:tid 62531] [client 103.163.220.46:28547] [client 103.163.220.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/widgets-form-function.php"] [unique_id "ahQC7xig0_XsOwmnrv_tJgAAAM4"]
[Mon May 25 16:06:07.740756 2026] [:error] [pid 3698:tid 3704] [client 103.163.220.17:31977] [client 103.163.220.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/true.php"] [unique_id "ahQC7wtZBEwA4fyFLKO7fQAAAQQ"]
[Mon May 25 16:06:08.121037 2026] [:error] [pid 62515:tid 62532] [client 103.163.220.7:47525] [client 103.163.220.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Proxy/"] [unique_id "ahQC8Big0_XsOwmnrv_tKAAAAM8"]
[Mon May 25 16:06:08.486950 2026] [:error] [pid 3698:tid 3717] [client 103.163.220.17:34333] [client 103.163.220.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/assets/wp-canser.php"] [unique_id "ahQC8AtZBEwA4fyFLKO7iAAAARE"]
[Mon May 25 16:06:08.854434 2026] [:error] [pid 3698:tid 3704] [client 103.163.220.38:53155] [client 103.163.220.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Exception/177.php"] [unique_id "ahQC8AtZBEwA4fyFLKO7iQAAAQQ"]
[Mon May 25 16:06:09.219331 2026] [:error] [pid 62427:tid 62461] [client 103.163.220.44:51457] [client 103.163.220.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/certificates/doc.php"] [unique_id "ahQC8fMUa83fc4GDyBxcUAAAAUQ"]
[Mon May 25 16:06:09.594323 2026] [:error] [pid 3698:tid 3716] [client 103.163.220.33:40031] [client 103.163.220.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/user/mariju.php"] [unique_id "ahQC8QtZBEwA4fyFLKO7jAAAARA"]
[Mon May 25 16:06:09.969723 2026] [:error] [pid 62722:tid 62727] [client 103.163.220.49:63381] [client 103.163.220.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/install-helper-new.php"] [unique_id "ahQC8aM6ssnLWYf6CVAeKwAAAEM"]
[Mon May 25 16:06:10.514495 2026] [:error] [pid 53791:tid 53801] [client 103.163.220.49:24527] [client 103.163.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/site-title-restful.php"] [unique_id "ahQC8iCRhhNTD40Nf1XVdgAAAYg"]
[Mon May 25 16:06:10.882096 2026] [:error] [pid 3698:tid 3709] [client 103.163.220.48:25485] [client 103.163.220.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/options-discussion-statement.php"] [unique_id "ahQC8gtZBEwA4fyFLKO7kgAAAQk"]
[Mon May 25 16:06:11.263483 2026] [:error] [pid 62722:tid 62743] [client 103.163.220.10:39551] [client 103.163.220.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/xmrlpc.php"] [unique_id "ahQC86M6ssnLWYf6CVAeMQAAAFM"]
[Mon May 25 16:06:11.628727 2026] [:error] [pid 62722:tid 62728] [client 103.125.146.81:35611] [client 103.125.146.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/uploads/connects.php"] [unique_id "ahQC86M6ssnLWYf6CVAeMwAAAEQ"]
[Mon May 25 16:06:11.996385 2026] [:error] [pid 53791:tid 53814] [client 103.163.220.39:44553] [client 103.163.220.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/well-known/acme-challenge/g/assets/msbp/admin.php"] [unique_id "ahQC8yCRhhNTD40Nf1XVfQAAAZU"]
[Mon May 25 16:06:12.367638 2026] [:error] [pid 53791:tid 53797] [client 103.163.220.46:34127] [client 103.163.220.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/upload.php"] [unique_id "ahQC9CCRhhNTD40Nf1XVgAAAAYQ"]
[Mon May 25 16:06:12.733917 2026] [:error] [pid 53791:tid 53799] [client 103.163.220.25:53303] [client 103.163.220.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wp/content/aswfy/admin.php"] [unique_id "ahQC9CCRhhNTD40Nf1XVgQAAAYY"]
[Mon May 25 16:06:13.101601 2026] [:error] [pid 53791:tid 53794] [client 103.125.146.81:35155] [client 103.125.146.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/rute.php"] [unique_id "ahQC9SCRhhNTD40Nf1XVhAAAAYE"]
[Mon May 25 16:06:13.472359 2026] [:error] [pid 62428:tid 62508] [client 103.163.220.8:32571] [client 103.163.220.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/htt.php"] [unique_id "ahQC9ZNosGBa7mui3VQa1gAAAJg"]
[Mon May 25 16:06:13.840772 2026] [:error] [pid 62515:tid 62533] [client 103.163.220.29:37035] [client 103.163.220.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/query-pagination/yosxb.php"] [unique_id "ahQC9Rig0_XsOwmnrv_tLgAAANA"]
[Mon May 25 16:06:14.209347 2026] [:error] [pid 53791:tid 53814] [client 103.163.220.39:28599] [client 103.163.220.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ezra-backup/"] [unique_id "ahQC9iCRhhNTD40Nf1XViAAAAZU"]
[Mon May 25 16:06:14.580969 2026] [:error] [pid 3698:tid 3720] [client 103.163.220.20:48753] [client 103.163.220.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/custom-cms/"] [unique_id "ahQC9gtZBEwA4fyFLKO7mAAAARQ"]
[Mon May 25 16:06:14.946716 2026] [:error] [pid 53791:tid 53805] [client 103.163.220.12:48989] [client 103.163.220.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/default/"] [unique_id "ahQC9iCRhhNTD40Nf1XVjAAAAYw"]
[Mon May 25 16:06:15.315988 2026] [:error] [pid 62428:tid 62499] [client 103.163.220.12:23809] [client 103.163.220.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/joel-test123/"] [unique_id "ahQC95NosGBa7mui3VQa1wAAAI8"]
[Mon May 25 16:06:15.683925 2026] [:error] [pid 62427:tid 62470] [client 103.163.220.32:32685] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/okbkh/content-"] [unique_id "ahQC9_MUa83fc4GDyBxcXQAAAU0"]
[Mon May 25 16:06:16.050352 2026] [:error] [pid 62515:tid 62527] [client 103.163.220.14:55679] [client 103.163.220.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/simple.php"] [unique_id "ahQC-Big0_XsOwmnrv_tMgAAAMo"]
[Mon May 25 16:06:16.533372 2026] [:error] [pid 62515:tid 62522] [client 103.163.220.36:46035] [client 103.163.220.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/simple.php"] [unique_id "ahQC-Big0_XsOwmnrv_tMwAAAMU"]
[Mon May 25 16:06:16.907190 2026] [:error] [pid 53791:tid 53814] [client 103.163.220.49:33751] [client 103.163.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/simple.php"] [unique_id "ahQC-CCRhhNTD40Nf1XVkAAAAZU"]
[Mon May 25 16:06:17.273787 2026] [:error] [pid 62428:tid 62497] [client 103.163.220.25:29767] [client 103.163.220.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/css/wp-conflg.php"] [unique_id "ahQC-ZNosGBa7mui3VQa3wAAAI0"]
[Mon May 25 16:06:17.641205 2026] [:error] [pid 3698:tid 3704] [client 103.163.220.46:30489] [client 103.163.220.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/img/bg/chosen.php"] [unique_id "ahQC-QtZBEwA4fyFLKO7oQAAAQQ"]
[Mon May 25 16:06:18.247582 2026] [:error] [pid 53791:tid 53803] [client 103.163.220.33:35429] [client 103.163.220.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/chosen.php"] [unique_id "ahQC-iCRhhNTD40Nf1XVlwAAAYo"]
[Mon May 25 16:06:18.613569 2026] [:error] [pid 3698:tid 3713] [client 103.163.220.28:53085] [client 103.163.220.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/ashyihk.php"] [unique_id "ahQC-gtZBEwA4fyFLKO7pAAAAQ0"]
[Mon May 25 16:06:18.977661 2026] [:error] [pid 62722:tid 62724] [client 103.163.220.52:56759] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/ads-txt/inc/wap1.php"] [unique_id "ahQC-qM6ssnLWYf6CVAePAAAAEA"]
[Mon May 25 16:06:19.345883 2026] [:error] [pid 3698:tid 3702] [client 103.163.220.30:51505] [client 103.163.220.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "ahQC-wtZBEwA4fyFLKO7pwAAAQI"]
[Mon May 25 16:06:19.715031 2026] [:error] [pid 53791:tid 53801] [client 103.163.220.14:32507] [client 103.163.220.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/about.php"] [unique_id "ahQC-yCRhhNTD40Nf1XVnQAAAYg"]
[Mon May 25 16:06:20.086867 2026] [:error] [pid 62427:tid 62472] [client 103.163.220.7:55255] [client 103.163.220.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/cache/tmp/dofault.php"] [unique_id "ahQC_PMUa83fc4GDyBxcYQAAAU8"]
[Mon May 25 16:06:20.457113 2026] [:error] [pid 62426:tid 62433] [client 103.163.220.40:32979] [client 103.163.220.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentyfive/parts/"] [unique_id "ahQC_Ej3D3Mo8ANpTRDHHAAAAAM"]
[Mon May 25 16:06:20.825614 2026] [:error] [pid 3698:tid 3710] [client 103.163.220.51:33583] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/css/colors/sunrise/file.php"] [unique_id "ahQC_AtZBEwA4fyFLKO7qQAAAQo"]
[Mon May 25 16:06:21.193077 2026] [:error] [pid 62428:tid 62498] [client 103.163.220.40:24131] [client 103.163.220.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/abilities-api/chosen.php"] [unique_id "ahQC_ZNosGBa7mui3VQa4gAAAI4"]
[Mon May 25 16:06:26.565010 2026] [:error] [pid 53791:tid 53797] [client 103.163.220.52:60697] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/images/user/"] [unique_id "ahQDAiCRhhNTD40Nf1XVuQAAAYQ"]
[Mon May 25 16:06:26.937004 2026] [:error] [pid 53791:tid 53793] [client 103.163.220.22:47343] [client 103.163.220.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade-temp-backup/photo-gallery/"] [unique_id "ahQDAiCRhhNTD40Nf1XVvAAAAYA"]
[Mon May 25 16:06:27.306603 2026] [:error] [pid 62722:tid 62729] [client 103.163.220.38:61397] [client 103.163.220.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/widgets/images/"] [unique_id "ahQDA6M6ssnLWYf6CVAeQQAAAEU"]
[Mon May 25 16:06:27.689620 2026] [:error] [pid 53791:tid 53796] [client 103.163.220.54:40847] [client 103.163.220.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/mu-plugins/block-library/"] [unique_id "ahQDAyCRhhNTD40Nf1XVwAAAAYM"]
[Mon May 25 16:06:28.058692 2026] [:error] [pid 62426:tid 62443] [client 103.163.220.20:33955] [client 103.163.220.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/ai1wm-backups/ID3/"] [unique_id "ahQDBEj3D3Mo8ANpTRDHIwAAAA0"]
[Mon May 25 16:06:28.426250 2026] [:error] [pid 3698:tid 3719] [client 103.163.220.18:48073] [client 103.163.220.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/wp-links.php"] [unique_id "ahQDBAtZBEwA4fyFLKO7rwAAARM"]
[Mon May 25 16:06:28.794113 2026] [:error] [pid 53791:tid 53806] [client 103.163.220.35:30633] [client 103.163.220.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/css/dist/admin-ui/"] [unique_id "ahQDBCCRhhNTD40Nf1XVwwAAAY0"]
[Mon May 25 16:06:29.173029 2026] [:error] [pid 53791:tid 53800] [client 103.163.220.23:53299] [client 103.163.220.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/user_data/SafetyTips/"] [unique_id "ahQDBSCRhhNTD40Nf1XVyAAAAYc"]
[Mon May 25 16:06:29.540320 2026] [:error] [pid 53791:tid 53802] [client 103.163.220.30:52101] [client 103.163.220.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/js/widgets/ws88.php"] [unique_id "ahQDBSCRhhNTD40Nf1XVyQAAAYk"]
[Mon May 25 16:06:29.919042 2026] [:error] [pid 62515:tid 62528] [client 103.163.220.24:27857] [client 103.163.220.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/images/media/zo.php"] [unique_id "ahQDBRig0_XsOwmnrv_tRgAAAMs"]
[Mon May 25 16:06:30.296560 2026] [:error] [pid 62515:tid 62540] [client 103.163.220.48:51533] [client 103.163.220.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/xltt.php"] [unique_id "ahQDBhig0_XsOwmnrv_tSAAAANc"]
[Mon May 25 16:06:30.663985 2026] [:error] [pid 53791:tid 53806] [client 103.163.220.11:47393] [client 103.163.220.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/providers/"] [unique_id "ahQDBiCRhhNTD40Nf1XVzgAAAY0"]
[Mon May 25 16:06:31.044066 2026] [:error] [pid 53791:tid 53814] [client 103.163.220.47:57919] [client 103.163.220.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/users.php"] [unique_id "ahQDByCRhhNTD40Nf1XV0QAAAZU"]
[Mon May 25 16:06:31.413468 2026] [:error] [pid 62722:tid 62738] [client 103.125.146.82:52513] [client 103.125.146.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/network/100.php"] [unique_id "ahQDB6M6ssnLWYf6CVAeQwAAAE4"]
[Mon May 25 16:06:31.841271 2026] [:error] [pid 53791:tid 53806] [client 103.163.220.32:38039] [client 103.163.220.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/zo.php"] [unique_id "ahQDByCRhhNTD40Nf1XV2QAAAY0"]
[Mon May 25 16:06:32.209094 2026] [:error] [pid 53791:tid 53814] [client 103.163.220.48:52895] [client 103.163.220.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wpxml.php"] [unique_id "ahQDCCCRhhNTD40Nf1XV3gAAAZU"]
[Mon May 25 16:06:32.589578 2026] [:error] [pid 62722:tid 62739] [client 103.163.220.37:33687] [client 103.163.220.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cgi-bin/cgi-bin/upload.php"] [unique_id "ahQDCKM6ssnLWYf6CVAeRQAAAE8"]
[Mon May 25 16:06:32.978684 2026] [:error] [pid 62515:tid 62524] [client 103.163.220.25:30183] [client 103.163.220.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/cgi-bin/cgi-bin/cgi-bin/cgi-bin/users.php"] [unique_id "ahQDCBig0_XsOwmnrv_tTwAAAMc"]
[Mon May 25 16:06:33.348076 2026] [:error] [pid 62722:tid 62730] [client 103.163.220.41:49681] [client 103.163.220.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/fonts/lato/wp-content/plugins/photo-gallery/admin/controllers/images/"] [unique_id "ahQDCaM6ssnLWYf6CVAeSwAAAEY"]
[Mon May 25 16:06:33.715368 2026] [:error] [pid 62515:tid 62530] [client 103.163.220.42:57967] [client 103.163.220.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/sitemaps/providers/fonts/"] [unique_id "ahQDCRig0_XsOwmnrv_tUAAAAM0"]
[Mon May 25 16:06:39.085456 2026] [:error] [pid 62426:tid 62441] [client 103.163.220.46:25785] [client 103.163.220.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/rithin.php"] [unique_id "ahQDD0j3D3Mo8ANpTRDHMwAAAAs"]
[Mon May 25 16:06:39.457292 2026] [:error] [pid 62427:tid 62470] [client 103.163.220.52:47547] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/news-portal/zdata.php"] [unique_id "ahQDD_MUa83fc4GDyBxcZgAAAU0"]
[Mon May 25 16:06:39.826635 2026] [:error] [pid 62428:tid 62495] [client 103.163.220.8:39111] [client 103.163.220.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/upgrade/chosen.php"] [unique_id "ahQDD5NosGBa7mui3VQa5QAAAIs"]
[Mon May 25 16:06:40.382341 2026] [:error] [pid 62722:tid 62735] [client 103.163.220.16:32327] [client 103.163.220.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/news-portal/wp-comand.php"] [unique_id "ahQDEKM6ssnLWYf6CVAeWAAAAEs"]
[Mon May 25 16:06:40.755831 2026] [:error] [pid 62722:tid 62731] [client 103.163.220.52:28061] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/wp-pages.php"] [unique_id "ahQDEKM6ssnLWYf6CVAeWQAAAEc"]
[Mon May 25 16:06:41.123682 2026] [:error] [pid 62722:tid 62724] [client 103.163.220.34:28235] [client 103.163.220.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/block-supports/wp-conflg.php"] [unique_id "ahQDEaM6ssnLWYf6CVAeWgAAAEA"]
[Mon May 25 16:06:41.497321 2026] [:error] [pid 62515:tid 62536] [client 103.163.220.48:30673] [client 103.163.220.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/news-portal/admins-dir.php"] [unique_id "ahQDERig0_XsOwmnrv_tXQAAANM"]
[Mon May 25 16:06:41.895122 2026] [:error] [pid 62427:tid 62459] [client 103.163.220.16:54777] [client 103.163.220.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/module.tag.lyrics3-class.php"] [unique_id "ahQDEfMUa83fc4GDyBxcawAAAUI"]
[Mon May 25 16:06:42.474346 2026] [:error] [pid 62722:tid 62725] [client 103.163.220.18:64085] [client 103.163.220.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/network/theme-install-variable.php"] [unique_id "ahQDEqM6ssnLWYf6CVAeXQAAAEE"]
[Mon May 25 16:06:42.846956 2026] [:error] [pid 3698:tid 3714] [client 103.163.220.14:33205] [client 103.163.220.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/post-excerpt/themes/"] [unique_id "ahQDEgtZBEwA4fyFLKO7tgAAAQ4"]
[Mon May 25 16:06:44.679168 2026] [:error] [pid 62722:tid 62744] [client 103.125.146.82:63593] [client 103.125.146.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/dt-the7/lib/jquery-sticky/theme-compat/"] [unique_id "ahQDFKM6ssnLWYf6CVAeXwAAAFQ"]
[Mon May 25 16:06:45.047887 2026] [:error] [pid 53791:tid 53808] [client 103.163.220.31:59761] [client 103.163.220.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/user/upgrade/"] [unique_id "ahQDFSCRhhNTD40Nf1XWAQAAAY8"]
[Mon May 25 16:06:45.415926 2026] [:error] [pid 53791:tid 53799] [client 103.163.220.51:28849] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-includes/customize/pki-validation/"] [unique_id "ahQDFSCRhhNTD40Nf1XWBQAAAYY"]
[Mon May 25 16:06:45.787372 2026] [:error] [pid 62515:tid 62528] [client 103.163.220.24:62163] [client 103.163.220.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/backups/admin.php"] [unique_id "ahQDFRig0_XsOwmnrv_tXwAAAMs"]
[Mon May 25 16:06:46.154742 2026] [:error] [pid 3698:tid 3719] [client 103.163.220.7:31991] [client 103.163.220.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/admin.php"] [unique_id "ahQDFgtZBEwA4fyFLKO7uwAAARM"]
[Mon May 25 16:06:46.524496 2026] [:error] [pid 3698:tid 3701] [client 103.163.220.31:40133] [client 103.163.220.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentytwentytwo/"] [unique_id "ahQDFgtZBEwA4fyFLKO7vQAAAQE"]
[Mon May 25 16:06:46.900669 2026] [:error] [pid 62515:tid 62532] [client 103.163.220.22:56977] [client 103.163.220.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins-off/core.php"] [unique_id "ahQDFhig0_XsOwmnrv_tYgAAAM8"]
[Mon May 25 16:06:47.275554 2026] [:error] [pid 53791:tid 53812] [client 103.163.220.51:52417] [client 103.163.220.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/my-custom-theme/config.php"] [unique_id "ahQDFyCRhhNTD40Nf1XWCQAAAZM"]
[Mon May 25 16:06:47.646840 2026] [:error] [pid 62515:tid 62531] [client 103.163.220.54:58667] [client 103.163.220.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/theme/config.php"] [unique_id "ahQDFxig0_XsOwmnrv_tZQAAAM4"]
[Mon May 25 16:06:48.019897 2026] [:error] [pid 62722:tid 62729] [client 103.163.220.52:44691] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/my-custom-theme/admin.php"] [unique_id "ahQDGKM6ssnLWYf6CVAeYQAAAEU"]
[Mon May 25 16:06:48.392495 2026] [:error] [pid 62428:tid 62501] [client 103.163.220.39:20271] [client 103.163.220.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/maxcoach/"] [unique_id "ahQDGJNosGBa7mui3VQa7QAAAJE"]
[Mon May 25 16:06:48.769331 2026] [:error] [pid 62426:tid 62438] [client 103.163.220.45:49841] [client 103.163.220.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/min.php"] [unique_id "ahQDGEj3D3Mo8ANpTRDHNQAAAAg"]
[Mon May 25 16:06:49.137984 2026] [:error] [pid 53791:tid 53804] [client 103.163.220.16:58809] [client 103.163.220.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/config.php"] [unique_id "ahQDGSCRhhNTD40Nf1XWCwAAAYs"]
[Mon May 25 16:06:49.512093 2026] [:error] [pid 53791:tid 53800] [client 103.125.146.82:51993] [client 103.125.146.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/kqsksia/classwithtostring.php"] [unique_id "ahQDGSCRhhNTD40Nf1XWDQAAAYc"]
[Mon May 25 16:06:49.880795 2026] [:error] [pid 62515:tid 62525] [client 103.163.220.22:20347] [client 103.163.220.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/man.php"] [unique_id "ahQDGRig0_XsOwmnrv_tZwAAAMg"]
[Mon May 25 16:06:50.267286 2026] [:error] [pid 62427:tid 62462] [client 103.163.220.18:26369] [client 103.163.220.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks/pullquote/1.php"] [unique_id "ahQDGvMUa83fc4GDyBxcbwAAAUU"]
[Mon May 25 16:06:50.634627 2026] [:error] [pid 62515:tid 62527] [client 103.163.220.40:40803] [client 103.163.220.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/oceanwp/sass/base/1.php"] [unique_id "ahQDGhig0_XsOwmnrv_taQAAAMo"]
[Mon May 25 16:06:51.195169 2026] [:error] [pid 53791:tid 53805] [client 103.163.220.14:23655] [client 103.163.220.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/blocks-other.php"] [unique_id "ahQDGyCRhhNTD40Nf1XWEgAAAYw"]
[Mon May 25 16:06:51.563057 2026] [:error] [pid 62427:tid 62476] [client 103.163.220.49:57615] [client 103.163.220.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/wp-wlx.php"] [unique_id "ahQDG_MUa83fc4GDyBxccwAAAVM"]
[Mon May 25 16:06:51.929082 2026] [:error] [pid 62428:tid 62504] [client 103.163.220.14:22051] [client 103.163.220.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/media-upload-double.php"] [unique_id "ahQDG5NosGBa7mui3VQa-wAAAJQ"]
[Mon May 25 16:06:52.298144 2026] [:error] [pid 62427:tid 62480] [client 103.163.220.41:59737] [client 103.163.220.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-admin/includes/class-wp-filesystem-ftpsockets-more.php"] [unique_id "ahQDHPMUa83fc4GDyBxcgQAAAVc"]
[Mon May 25 16:06:52.665590 2026] [:error] [pid 62515:tid 62524] [client 103.163.220.52:50527] [client 103.163.220.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/themes/twentynineteen/content-"] [unique_id "ahQDHBig0_XsOwmnrv_tbAAAAMc"]
[Mon May 25 16:06:53.035178 2026] [:error] [pid 62515:tid 62531] [client 103.163.220.19:56413] [client 103.163.220.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "perthactive.com.au"] [uri "/wp-content/plugins/wordpress-seo/"] [unique_id "ahQDHRig0_XsOwmnrv_tcAAAAM4"]
[Mon May 25 16:45:59.394949 2026] [:error] [pid 62427:tid 62467] [client 170.64.224.245:45748] [client 170.64.224.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "ahQMR_MUa83fc4GDyBxhwwAAAUo"]
[Mon May 25 16:45:59.523528 2026] [:error] [pid 62722:tid 62744] [client 170.64.224.245:42024] [client 170.64.224.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.git/config"] [unique_id "ahQMR6M6ssnLWYf6CVAnZQAAAFQ"]
[Mon May 25 16:45:59.856542 2026] [:error] [pid 62428:tid 62502] [client 170.64.224.245:45798] [client 170.64.224.245] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||perthactive.com.au|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "perthactive.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "ahQMR5NosGBa7mui3VQhvwAAAJI"]
[Mon May 25 18:18:48.295576 2026] [:error] [pid 62428:tid 62488] [client 142.248.80.72:8186] [client 142.248.80.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/backend/.env"] [unique_id "ahQiCJNosGBa7mui3VQuIwAAAIQ"]
[Mon May 25 18:18:48.296266 2026] [:error] [pid 62428:tid 62495] [client 142.248.80.72:8172] [client 142.248.80.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/api/.env"] [unique_id "ahQiCJNosGBa7mui3VQuJQAAAIs"]
[Mon May 25 18:18:48.354821 2026] [:error] [pid 62722:tid 62731] [client 142.248.80.72:8168] [client 142.248.80.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/app/.env"] [unique_id "ahQiCKM6ssnLWYf6CVA30AAAAEc"]
[Mon May 25 18:18:48.355092 2026] [:error] [pid 53791:tid 53800] [client 142.248.80.72:8130] [client 142.248.80.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env"] [unique_id "ahQiCCCRhhNTD40Nf1UBiQAAAYc"]
[Mon May 25 18:18:48.355692 2026] [:error] [pid 62426:tid 62440] [client 142.248.80.72:8144] [client 142.248.80.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.local"] [unique_id "ahQiCEj3D3Mo8ANpTRDf4QAAAAo"]
[Mon May 25 18:18:49.656850 2026] [:error] [pid 62426:tid 62435] [client 142.248.80.72:8154] [client 142.248.80.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "perthactive.com.au"] [uri "/.env.production"] [unique_id "ahQiCUj3D3Mo8ANpTRDf6gAAAAU"]
[Mon May 25 19:56:41.526555 2026] [:error] [pid 3698:tid 3715] [client 103.197.74.199:30142] [client 103.197.74.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.197.74.199, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ahQ4-QtZBEwA4fyFLKPrrgAAAQ8"]
[Tue May 26 01:06:09.209857 2026] [:error] [pid 3698:tid 3723] [client 20.104.106.53:10806] [client 20.104.106.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.104.106.53, incrementing brute counter"] [hostname "perthactive.com.au"] [uri "/wp-login.php"] [unique_id "ahSBgQtZBEwA4fyFLKMblgAAARc"]
[Tue May 26 01:06:17.395310 2026] [:error] [pid 62426:tid 62454] [client 20.104.106.53:18657] [client 20.104.106.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.104.106.53, incrementing ddos counter"] [hostname "perthactive.com.au"] [uri "/xmlrpc.php"] [unique_id "ahSBiUj3D3Mo8ANpTRBfFAAAABg"]
[Tue May 26 01:06:24.830564 2026] [autoindex:error] [pid 62428:tid 62495] [client 20.104.106.53:28387] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 26 01:06:25.040185 2026] [autoindex:error] [pid 62428:tid 62484] [client 20.104.106.53:28387] AH01276: Cannot serve directory /home/perthactivecom/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 26 01:06:27.314299 2026] [autoindex:error] [pid 53791:tid 53813] [client 20.104.106.53:63220] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 26 01:06:27.527296 2026] [:error] [pid 53791:tid 53805] [client 20.104.106.53:63220] [client 20.104.106.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "perthactive.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ahSBkyCRhhNTD40Nf1VOZwAAAYw"]
[Tue May 26 01:06:30.159221 2026] [autoindex:error] [pid 3698:tid 3716] [client 20.104.106.53:9769] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 26 01:06:30.379106 2026] [autoindex:error] [pid 3698:tid 3711] [client 20.104.106.53:9769] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 26 01:06:32.150606 2026] [autoindex:error] [pid 62515:tid 62536] [client 20.104.106.53:33799] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 26 01:06:32.368762 2026] [autoindex:error] [pid 62515:tid 62518] [client 20.104.106.53:33799] AH01276: Cannot serve directory /home/perthactivecom/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 26 17:05:08.224890 2026] [:error] [pid 20025:tid 20084] [client 34.11.17.55:57246] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/"] [unique_id "ahViRH7k8Vts-JPOkgXPpwAAAFM"]
[Tue May 26 17:05:08.653160 2026] [:error] [pid 55988:tid 56009] [client 34.11.17.55:53424] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahViRP3kVIz2sql52sdhtgAAARI"]
[Tue May 26 17:05:09.081087 2026] [:error] [pid 55988:tid 56000] [client 34.11.17.55:60598] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "perthactive.com.au"] [uri "/feed/"] [unique_id "ahViRf3kVIz2sql52sdh-AAAAQk"]
[Tue May 26 17:36:18.521343 2026] [:error] [pid 33887:tid 33932] [client 20.206.111.238:36476] [client 20.206.111.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "perthactive.com.au"] [uri "/tiny.php"] [unique_id "ahVpktCOI_FV7meOxGf4HgAAAI0"]